CVE-2026-101050: Heym before 0.0.53 Authentication Bypass via Telegram Webhook
Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execute actions on attacker-supplied input.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Heymto a version that resolves this vulnerability.Fixed in 0.0.53
Event History
Frequently Asked Questions
Which deployments are exposed to forged Telegram updates?
Heym deployments before 0.0.53 are exposed when a Telegram webhook endpoint has no credential_id or has an empty secret_token. In that state, the endpoint does not verify Telegram's X-Telegram-Bot-Api-Secret-Token header.
Does exploitation require an authenticated account or user interaction?
No. A remote attacker can exploit the issue without authentication or user interaction by posting forged Telegram updates to an affected webhook endpoint.
What can an attacker do through a successful forged update?
A forged update can trigger workflows using the owner's configured credentials and cause actions to run on attacker-supplied input.
How can I determine whether my instance is affected?
Check whether the Heym version is earlier than 0.0.53 and review Telegram webhook configurations. A webhook is affected if credential_id is absent or secret_token is empty.