CVE-2026-100859: Heym Credential Exfiltration Vulnerability

CVE-2026-100859 Overview

CVE-2026-100859 is a credential exfiltration vulnerability in Heym versions prior to 0.0.106. The flaw resides in the POST /api/credentials/test endpoint, which fails to validate the destination URL supplied in the config parameter. Collaborators who have shared access to a credential can override the target URL and redirect the server to send decrypted authentication secrets to an attacker-controlled endpoint. The issue is tracked as a Server-Side Request Forgery weakness [CWE-918]. Exploitation requires only low-privilege authenticated access and no user interaction.

Critical Impact
Authenticated collaborators can exfiltrate the plaintext secrets of credential owners by redirecting server-side test requests to attacker-controlled hosts.

Affected Products

Heym versions prior to 0.0.106
Deployments exposing the /api/credentials/test endpoint
Multi-user Heym instances using shared credential collaboration features

Discovery Timeline

2026-09-27 - CVE-2026-100859 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100859

Vulnerability Analysis

Heym exposes the POST /api/credentials/test endpoint to validate stored credentials against their target services. The endpoint accepts a config object that includes the destination URL used for the outbound test request. The server decrypts the stored credential, attaches it to the outbound request, and sends it to the URL supplied in config. Because the destination URL is attacker-controlled, any user with shared access to a credential can redirect the request to an external listener and capture the plaintext secret in the authentication header or request body. The weakness aligns with Server-Side Request Forgery patterns documented under CWE-918.

Root Cause

The root cause is missing validation and allow-listing on the destination URL used by the credential test routine. The server trusts a client-supplied field to determine where decrypted secrets are transmitted. Shared credential access was designed to allow collaborators to invoke the test workflow, but authorization checks did not restrict the destination to the credential's original service endpoint.

Attack Vector

Exploitation requires authenticated access as a collaborator with permission to use the shared credential. The attacker sends a crafted POST request to /api/credentials/test with a config.url value pointing at an attacker-controlled HTTP listener. The Heym server decrypts the owner's secret, embeds it in the outbound test request, and transmits it to the attacker's endpoint. Full technical details are published in the GitHub Security Advisory GHSA-39qx and the VulnCheck Credential Exfiltration Advisory.

Detection Methods for CVE-2026-100859

Indicators of Compromise

Outbound HTTP(S) requests from Heym servers to domains that do not match the original credential's target service.
POST /api/credentials/test requests containing config URLs pointing to recently registered or free-hosting domains.
Authentication headers or bearer tokens appearing in traffic to unexpected external hosts.

Detection Strategies

Inspect Heym application logs for /api/credentials/test invocations and correlate the destination URL against the stored credential's registered endpoint.
Alert on any discrepancy between the credential's configured service host and the URL used during a test request.
Flag collaborator accounts invoking the test endpoint for credentials they did not create.

Monitoring Recommendations

Enable egress logging from Heym servers and baseline normal destination hosts for credential testing.
Forward Heym access logs to a centralized SIEM for correlation with authentication and user-management events.
Monitor for repeated test requests from the same user against multiple shared credentials in a short time window.

How to Mitigate CVE-2026-100859

Immediate Actions Required

Upgrade Heym to version 0.0.106 or later immediately.
Rotate every secret that was shared with collaborators on affected instances.
Audit historical access logs for /api/credentials/test calls and review destination URLs for anomalies.
Revoke collaborator access to sensitive credentials until the upgrade is verified.

Patch Information

The vendor fixed the issue in Heym 0.0.106. Patch details are published in the GitHub Security Advisory GHSA-39qx. Administrators should upgrade all Heym instances and verify the running version after deployment.

Workarounds

Restrict collaborator access to shared credentials until the patched version is deployed.
Place Heym behind an egress proxy that enforces an allow-list of permitted destination hosts for credential testing.
Disable the /api/credentials/test endpoint at the reverse-proxy layer if business workflows permit.

bash

# Example egress allow-list enforcement at the reverse proxy
# Block Heym outbound test traffic to anything outside approved service hosts
location /api/credentials/test {
    # Only forward requests whose config.url targets approved hosts
    access_by_lua_file /etc/nginx/lua/validate_credential_test_url.lua;
    proxy_pass http://heym_upstream;
}