Vulnerability · Published Sep 27, 2026 · Assigned by VulnCheck

CVE-2026-100859Heym before 0.0.106 Credential Exfiltration via URL Override

Medium 6.5

In plain English

A medium-severity server-side request forgery in heym from heymrun. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 83.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the server to send decrypted authentication secrets to attacker-controlled endpoints.

Affected products (as reported)

Vendor	Product	Versions
heymrun	heym	0 – before 0.0.106

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-39qx-wp7x-69rq) vendor-advisory
VulnCheck Advisory: Heym before 0.0.106 Credential Exfiltration via URL Override third-party-advisory