{"id":"CVE-2026-105396","published":"2026-10-05T12:17:09.583","lastModified":"2026-10-05T16:00:27.123","description":"Heym before v0.0.112 contains a token leakage vulnerability in build_public_base_url() that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to attacker domains, capturing capability tokens to submit decisions executed with owner credentials.","cvssScore":5.4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cwes":["CWE-346"],"vendors":[],"products":[],"references":[{"url":"https://github.com/heymrun/heym/security/advisories/GHSA-6rv3-wh25-7pg5","tags":[]},{"url":"https://www.vulncheck.com/advisories/heym-before-0.0.112-hitl-review-token-leak-via-spoofable-origin-header","tags":[]}],"exploitRefs":[{"url":"https://github.com/heymrun/heym/security/advisories/GHSA-6rv3-wh25-7pg5","tags":[]}],"hasPoc":true,"ai":null}