← Back
2026-09-27 1:28CVE-2026-100859VulnCheck
PUBLISHED5.2CWE-918

Heym before 0.0.106 Credential Exfiltration via URL Override

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the server to send decrypted authentication secrets to attacker-controlled endpoints.

Problem type

Affected products

heymrun

heym

< 0.0.106 - AFFECTED

0.0.106 - UNAFFECTED

References

GitHub Security Advisory (GHSA-39qx-wp7x-69rq)

https://github.com/heymrun/heym/security/advisories/GHSA-39qx-wp7x-69rq

vendor-advisory
VulnCheck Advisory: Heym before 0.0.106 Credential Exfiltration via URL Override

https://www.vulncheck.com/advisories/heym-before-0.0.106-credential-exfiltration-via-url-override

third-party-advisory

GitHub Security Advisories

GHSA-33w4-w3j3-cmvg

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials...

https://github.com/advisories/GHSA-33w4-w3j3-cmvg

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the server to send decrypted authentication secrets to attacker-controlled endpoints.

github.com

https://github.com/heymrun/heym/security/advisories/GHSA-39qx-wp7x-69rq

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2026-100859

vulncheck.com

https://www.vulncheck.com/advisories/heym-before-0.0.106-credential-exfiltration-via-url-override

github.com

https://github.com/advisories/GHSA-33w4-w3j3-cmvg

JSON source

https://cveawg.mitre.org/api/cve/CVE-2026-100859
Click to expand
{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "cveMetadata": {
    "cveId": "CVE-2026-100859",
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "dateUpdated": "2026-09-27T01:28:49.880Z",
    "dateReserved": "2026-09-27T00:20:03.854Z",
    "datePublished": "2026-09-27T01:28:49.880Z",
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck",
        "dateUpdated": "2026-09-27T01:28:49.880Z"
      },
      "datePublic": "2026-09-05T00:00:00.000Z",
      "title": "Heym before 0.0.106 Credential Exfiltration via URL Override",
      "descriptions": [
        {
          "lang": "en",
          "value": "Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the server to send decrypted authentication secrets to attacker-controlled endpoints."
        }
      ],
      "affected": [
        {
          "vendor": "heymrun",
          "product": "heym",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "0.0.106"
            },
            {
              "version": "0.0.106",
              "status": "unaffected",
              "versionType": "semver"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "Server-Side Request Forgery (SSRF)",
              "cweId": "CWE-918",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://github.com/heymrun/heym/security/advisories/GHSA-39qx-wp7x-69rq",
          "name": "GitHub Security Advisory (GHSA-39qx-wp7x-69rq)",
          "tags": [
            "vendor-advisory"
          ]
        },
        {
          "url": "https://www.vulncheck.com/advisories/heym-before-0.0.106-credential-exfiltration-via-url-override",
          "name": "VulnCheck Advisory: Heym before 0.0.106 Credential Exfiltration via URL Override",
          "tags": [
            "third-party-advisory"
          ]
        }
      ],
      "metrics": [
        {
          "format": "CVSS"
        },
        {
          "format": "CVSS",
          "cvssV3_1": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "LOW",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM"
          }
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "roonakyadav",
          "type": "reporter"
        },
        {
          "lang": "en",
          "value": "mbakgun",
          "type": "finder"
        }
      ]
    }
  }
}