CVE-2026-101049: Heym Auth Bypass Vulnerability

CVE-2026-101049 Overview

CVE-2026-101049 is an authentication bypass vulnerability [CWE-287] in Heym versions before 0.0.53. The flaw affects Slack webhook signature verification in trigger nodes. When a trigger node lacks a credentialId or has an empty signing secret, Heym skips signature verification entirely. Remote unauthenticated attackers can forge Slack events and send them to known webhook URLs. The forged events trigger workflows that execute with the workflow owner's credentials.

Critical Impact
Unauthenticated attackers who know a webhook URL can trigger arbitrary workflows and operate under the owner's credentials, enabling abuse of connected integrations and downstream services.

Affected Products

Heym versions prior to 0.0.53
Slack trigger nodes without a configured credentialId
Trigger nodes with empty or missing signing secrets

Discovery Timeline

2026-09-27 - CVE-2026-101049 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-101049

Vulnerability Analysis

Heym exposes HTTP webhook endpoints that drive workflow automation triggered by Slack events. For each incoming request, the backend attempts to validate the Slack signature using the HMAC signing secret associated with the trigger node's credential. The verification path is gated by the presence of a credential_id and a non-empty signing_secret. When either value is missing, the handler proceeds to execute the workflow without validating the x-slack-signature header. This fails open rather than fails closed. An attacker who learns a webhook URL can submit arbitrary JSON payloads that the server treats as authentic Slack events.

The same pattern affects the Telegram trigger handler in backend/app/api/telegram.py, where a missing credential_id, missing config, or empty secret_token skips verification of the x-telegram-bot-api-secret-token header.

Root Cause

The root cause is improper authentication logic in backend/app/api/slack.py. The code checks if credential_id: and if signing_secret: before invoking _verify_slack_signature. When these preconditions are not met, no error is raised and the workflow executes with the owner's credentials. This is a classic fail-open authentication design flaw mapped to [CWE-287].

Attack Vector

Exploitation requires network access to the Heym webhook endpoint and knowledge of a valid webhook URL. The attacker crafts a POST request mimicking a Slack event payload. No x-slack-signature or x-slack-request-timestamp headers are needed when the target node has no credential or an empty secret. The server executes the triggered workflow, invoking any downstream integrations with the workflow owner's stored credentials.

python

     if trigger_node:
         credential_id = trigger_node.get("data", {}).get("credentialId") or None
 
-    # Verify Slack signature if credential is configured
-    if credential_id:
-        async with async_session_maker() as db:
-            signing_secret = await _get_signing_secret(db, credential_id)
-
-        if signing_secret:
-            timestamp = request.headers.get("x-slack-request-timestamp", "")
-            signature = request.headers.get("x-slack-signature", "")
-            if not _verify_slack_signature(signing_secret, raw_body, timestamp, signature):
-                logger.warning(
-                    "Invalid Slack signature for node_id=%s",
-                    node_id,
-                )
-                raise HTTPException(
-                    status_code=status.HTTP_403_FORBIDDEN,
-                    detail="Invalid Slack signature",
-                )
-    else:
+    # SECURITY: Slack webhook signature verification must fail closed.
+    # See security advisory GHSA-pm6h-x3h5-j38h, finding H1. Previously, a missing
+    # credential_id or empty signing_secret caused verification to be skipped
+    # entirely, allowing anyone with the webhook URL to trigger the workflow with
+    # the owner's credentials.

Source: GitHub Commit 341d1012

Detection Methods for CVE-2026-101049

Indicators of Compromise

Incoming POST requests to Slack or Telegram webhook endpoints lacking x-slack-signature, x-slack-request-timestamp, or x-telegram-bot-api-secret-token headers.
Workflow executions triggered from source IP ranges outside of Slack's or Telegram's published egress ranges.
Unexpected workflow activity associated with trigger nodes that have no credentialId configured.

Detection Strategies

Log and alert on webhook invocations where signature verification was skipped due to missing credentials.
Correlate workflow execution events with the presence or absence of valid signature headers in request logs.
Baseline the geographic and ASN distribution of webhook callers, flagging deviations from Slack and Telegram infrastructure.

Monitoring Recommendations

Monitor the backend/app/api/slack.py and backend/app/api/telegram.py endpoints for anomalous request rates.
Audit the server log line Invalid Slack signature for node_id=%s and the Telegram warning webhook rejected: no credential_id introduced in the patch.
Track all trigger nodes lacking a credentialId and treat them as high-risk until remediated.

How to Mitigate CVE-2026-101049

Immediate Actions Required

Upgrade Heym to version 0.0.53 or later immediately.
Audit all Slack and Telegram trigger nodes to confirm a valid credentialId and non-empty signing secret are configured.
Rotate any webhook URLs that may have been exposed, as URL knowledge was sufficient for exploitation.
Review workflow execution history for unauthorized triggers since deployment.

Patch Information

The fix is in commit 341d1012367cd74f85c617e1c98dd49e3fcb5e83, shipped in Heym 0.0.53. The patch enforces fail-closed semantics: requests to webhook endpoints are rejected when credential_id is missing or when the associated signing secret or Telegram secret token is empty. Client-facing errors are intentionally generic to prevent probing. See the GitHub Security Advisory GHSA-pm6h-x3h5-j38h and the VulnCheck Advisory for additional context.

Workarounds

Place Heym webhook endpoints behind a reverse proxy that restricts source IPs to Slack and Telegram published ranges.
Enforce a Web Application Firewall (WAF) rule rejecting webhook requests missing x-slack-signature headers.
Disable or delete any trigger nodes that cannot be configured with a credential and signing secret until upgrade is complete.

bash

# Example nginx rule to require Slack signature headers
location /api/slack/webhook {
    if ($http_x_slack_signature = "") { return 403; }
    if ($http_x_slack_request_timestamp = "") { return 403; }
    proxy_pass http://heym_backend;
}