Read the docs
TI-2026-80467 Aliases CVE-2026-116368GHSA-4m7q-ghvx-6vx5

Improper authorization in DeepSeek browser authentication

Priority LOW 37CWE-266Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation, Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-266 and CWE-285.

Summary

DeepSeek versions 0.2.0-rc.0, 0.2.0-rc.1 and 0.2.0-rc.2 are affected. The browser authentication code in browser-auth.ts of the Browser Auth component does not enforce authorization correctly, which is classified as CWE-285 (Improper Authorization). A remote attacker with no privileges and no user interaction can affect confidentiality, integrity and availability to a limited degree.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the component Browser Auth. This manipulation causes improper authorization. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00583 48th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DeepSeekHarness0.2.0-rc.0; 0.2.0-rc.1; 0.2.0-rc.2—No fix listedCNA
  • Harness VendorDeepSeek Affected 0.2.0-rc.0; 0.2.0-rc.1; 0.2.0-rc.2 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:deepseek:harness:*:*:*:*:*:*:*:*——DeepSeek
  • cpe:2.3:a:deepseek:harness:*:*:*:*:*:*:*:* Versions — — ·DeepSeek

Remediation

The sources list no fixed version for DeepSeek.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-116368
  2. 2026-10-26 CISA SSVC decision points changed
  3. 2026-10-26 Priority changed: MEDIUM → LOW
  4. 2026-10-27 Alias added: GHSA-4m7q-ghvx-6vx5

References

—

  • TI-2025-19267 DeepSeek R1 through V3.1 allows XSS, as demonstrated by JavaScript execution in the… CVSS 3.1HIGH 8.8
  • TI-2026-80466 Access control flaw in DeepSeek sandbox createContext CVSS 4.0MEDIUM 5.3
  • TI-2026-65141 DeepSeek deepseek-harness Bundle Patch profile.ts loadProfile path traversal CVSS 4.0LOW 2.3
  • TI-2026-56891 DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing CVSS 4.0CRITICAL 9.4
  • TI-2025-39472 DeepSeek V3.2 has a Cross Site Scripting (XSS) vulnerability, which allows JavaScript… CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences