CVE-2026-100859: Heym before 0.0.106 Credential Exfiltration via URL Override
Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the server to send decrypted authentication secrets to attacker-controlled endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Heymto a version that resolves this vulnerability.Fixed in 0.0.106
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be a collaborator with shared access to a credential. The issue is remotely reachable and does not require user interaction.
What access or conditions are required to exfiltrate a secret?
The attacker needs access to the POST /api/credentials/test endpoint for a shared credential and must be able to supply a config parameter that overrides the destination URL. This causes the server to send the decrypted authentication secret to an attacker-controlled endpoint.
Which versions are affected?
Heym versions before 0.0.106 are affected. Upgrading to 0.0.106 or later addresses the affected version range.
What can be done if an upgrade is not immediately possible?
Restrict shared credential access to trusted collaborators and prevent untrusted users from invoking the credential test endpoint. Review and limit configuration that permits destination URL overrides, where possible.
How can defenders look for possible exploitation?
Review requests to POST /api/credentials/test for config values containing unexpected or attacker-controlled destination URLs. Also investigate outbound requests from the Heym server to unrecognized endpoints made during credential testing.