What’s Vulnerable › Vulnerabilities

CVE-2026-105396: Heym before v0.0.112 HITL Review Token Leak via Spoofable Origin Header

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-05 · updated 2026-10-05
• Weakness: CWE-346

Description

Heym before v0.0.112 contains a token leakage vulnerability in build_public_base_url() that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to attacker domains, capturing capability tokens to submit decisions executed with owner credentials.

Affected products

• heymrun heym: before 0.0.112 — fixed in 0.0.112

How to fix

Upgrade to a fixed version: heymrun heym 0.0.112. Check the vendor advisory for mitigations.

References

• https://github.com/heymrun/heym/security/advisories/GHSA-6rv3-wh25-7pg5
• https://www.vulncheck.com/advisories/heym-before-0.0.112-hitl-review-token-leak-via-spoofable-origin-header

Get alerted when CVE-2026-105396 or the next vulnerability affects your stack