CVE-2026-105396

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-105396

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105396.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-105396

Aliases

GHSA-6rv3-wh25-7pg5

Published

2026-10-05T11:09:45Z

Modified

2026-10-28T02:30:53Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Heym before v0.0.112 HITL Review Token Leak via Spoofable Origin Header

Details

Heym before v0.0.112 contains a token leakage vulnerability in build_public_base_url() that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to attacker domains, capturing capability tokens to submit decisions executed with owner credentials.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-346"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105396.json"
}

References

Affected packages

Git / github.com/heymrun/heym

Affected ranges

Type

GIT

Repo

https://github.com/heymrun/heym

Events

Introduced

Fixed

20279736e7c34c7ca3e8bae36184f31a1c64795a

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.0.112"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.0.112"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

0.*

0.0.70

0.0.71

0.0.73

Other

codex-pr-assets

opencode-pr-assets

v.*

v.0.0.49

v0.*

v0.0.1

v0.0.10

v0.0.100

v0.0.101

v0.0.102

v0.0.103

v0.0.104

v0.0.105

v0.0.106

v0.0.107

v0.0.108

v0.0.109

v0.0.11

v0.0.110

v0.0.111

v0.0.12

v0.0.13

v0.0.14

v0.0.15

v0.0.16

v0.0.17

v0.0.18

v0.0.19

v0.0.2

v0.0.20

v0.0.21

v0.0.22

v0.0.23

v0.0.24

v0.0.25

v0.0.26

v0.0.27

v0.0.29

v0.0.3

v0.0.30

v0.0.31

v0.0.32

v0.0.33

v0.0.34

v0.0.35

v0.0.36

v0.0.37

v0.0.38

v0.0.39

v0.0.4

v0.0.40

v0.0.41

v0.0.42

v0.0.43

v0.0.44

v0.0.45

v0.0.46

v0.0.47

v0.0.48

v0.0.5

v0.0.50

v0.0.51

v0.0.52

v0.0.53

v0.0.54

v0.0.55

v0.0.56

v0.0.57

v0.0.58

v0.0.59

v0.0.6

v0.0.60

v0.0.61

v0.0.62

v0.0.63

v0.0.64

v0.0.65

v0.0.66

v0.0.67

v0.0.68

v0.0.69

v0.0.7

v0.0.72

v0.0.74

v0.0.75

v0.0.76

v0.0.77

v0.0.78

v0.0.79

v0.0.8

v0.0.80

v0.0.81

v0.0.82

v0.0.83

v0.0.84

v0.0.85

v0.0.86

v0.0.87

v0.0.88

v0.0.89

v0.0.9

v0.0.90

v0.0.91

v0.0.92

v0.0.93

v0.0.94

v0.0.95

v0.0.96

v0.0.97

v0.0.98

v0.0.99

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105396.json"