CVE-2026-100859
Heym before 0.0.106 Credential Exfiltration via URL Override
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 27, 2026
- Updated
- Sep 30, 2026
- Reserved
- Sep 27, 2026
Description
Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the server to send decrypted authentication secrets to attacker-controlled endpoints.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
heymheymrun |
|
References
- GitHub Security Advisory (GHSA-39qx-wp7x-69rq)vendor-advisory
- VulnCheck Advisory: Heym before 0.0.106 Credential Exfiltration via URL Overridethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.