CVE-2026-100859 Heym before 0.0.106 Credential Exfiltration via URL Override
Attackers can exfiltrate decrypted authentication secrets by overriding the destination URL in the credential test endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-100859?
CVE-2026-100859 is a high-severity server-side request forgery vulnerability in heymrun heym, published on 27 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the server to send decrypted authentication secrets to attacker-controlled endpoints.
Weakness: CWE-918
Which versions are affected by CVE-2026-100859?
How do I fix CVE-2026-100859?
No fix has been published for CVE-2026-100859 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-100859 being exploited?
There is no known exploitation of CVE-2026-100859 in the wild and no public exploit code.
Sources
Also known as GHSA-33w4-w3j3-cmvg, GHSA-39qx-wp7x-69rq.