CVE-2026-82291: HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HeyFormto a version that resolves this vulnerability.Fixed in 3.0.0-rc.8 - Configuration
In HeyForm versions before 3.0.0-rc.8, stop reflecting the request Origin header in CORS responses while allowing credentials; instead restrict CORS origins to trusted origins so authenticated cross-origin requests from malicious pages are blocked.
HeyForm CORS CORS response behavior for Origin header when Allow-Credentials is enabled = Do not reflect arbitrary request Origin; restrict allowed origins
Event History
Frequently Asked Questions
Which users and data are exposed during an attack?
Logged-in HeyForm users who visit an attacker-controlled page are exposed. The attacker can access workspaces, projects, forms, submissions, and respondent data through authenticated GraphQL queries, and can modify account settings.
What does an attacker need to exploit this issue?
The attacker needs to cause a logged-in user to visit a malicious web page. No attacker authentication or special privileges are required.
Which deployments should be treated as affected?
HeyForm versions before 3.0.0-rc.8 are affected. Deployments on an earlier version should be upgraded to 3.0.0-rc.8 or later.