CVE-2026-82291 HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials
HeyForm reflects any Origin in CORS responses with credentials, allowing attackers to execute authenticated GraphQL queries to read or modify user data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-82291?
CVE-2026-82291 is a high-severity vulnerability in heyform, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings.
Weakness: CWE-942
Which versions are affected by CVE-2026-82291?
How do I fix CVE-2026-82291?
No fix has been published for CVE-2026-82291 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-82291 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82291 exists.
Sources
Also known as GHSA-69g7-vm8m-997r, GHSA-fg7j-rmgr-rc9g.