Vulnerability · Published Oct 5, 2026 · Assigned by VulnCheck

CVE-2026-105396Heym before v0.0.112 HITL Review Token Leak via Spoofable Origin Header

Medium 5.4

In plain English

A medium-severity security flaw in heym from heymrun. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)<0.1%top 99.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Heym before v0.0.112 contains a token leakage vulnerability in build_public_base_url() that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to attacker domains, capturing capability tokens to submit decisions executed with owner credentials.

Affected products (as reported)

Vendor	Product	Versions
heymrun	heym	0 – before 0.0.112

Weakness: CWE-346 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-6rv3-wh25-7pg5) vendor-advisory
VulnCheck Advisory: Heym before v0.0.112 HITL Review Token Leak via Spoofable Origin Header third-party-advisory