Vulnerability · Published Sep 27, 2026 · Assigned by VulnCheck
CVE-2026-101049Heym before 0.0.53 Slack Webhook Signature Verification Bypass
Medium 6.5
In plain English
A medium-severity improper authentication in heym from heymrun. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 67.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets. Remote unauthenticated attackers can send forged Slack events to known webhook URLs to trigger workflows with the owner's credentials.
Affected products (as reported)
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
References
- GitHub Security Advisory (GHSA-pm6h-x3h5-j38h) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: Heym before 0.0.53 Slack Webhook Signature Verification Bypass third-party-advisory