CVE-2026-105396: Heym Token Leakage Auth Bypass Vulnerability

CVE-2026-105396 Overview

CVE-2026-105396 is a token leakage vulnerability in Heym versions before 0.0.112. The flaw resides in the build_public_base_url() function, which trusts attacker-controlled HTTP headers when constructing Human-in-the-Loop (HITL) review URLs. Unauthenticated attackers can spoof the Origin or X-Forwarded-Host headers to redirect reviewer notification links to attacker-controlled domains. When a reviewer clicks the forged link, the embedded capability token is sent to the attacker. The attacker can then submit review decisions that execute under the legitimate owner's credentials. The weakness is classified under CWE-346: Origin Validation Error.

Critical Impact

Attackers who capture HITL capability tokens can submit arbitrary review decisions that execute with owner credentials, subverting the human approval control in anonymous workflows.

Affected Products

• Heym versions prior to 0.0.112
• Deployments exposing anonymous HITL workflows
• Instances behind reverse proxies that forward untrusted X-Forwarded-Host headers

Discovery Timeline

• 2026-10-05 - CVE-2026-105396 published to the National Vulnerability Database (NVD)
• 2026-10-05 - Last updated in NVD database

Technical Details for CVE-2026-105396

Vulnerability Analysis

The vulnerability lives inside Heym's build_public_base_url() helper. This function constructs the base URL used in reviewer notification emails and HITL review links. Rather than deriving the base URL from a trusted server-side configuration, the function trusts the inbound HTTP request's Origin and X-Forwarded-Host headers.

Heym's HITL workflow issues short-lived capability tokens embedded in review URLs. These tokens authorize a reviewer to approve or reject actions on behalf of the workflow owner. When the base URL is attacker-controlled, the complete review URL — including the capability token — points to a host operated by the attacker.

Because the attack targets anonymous workflows, no authentication is required to trigger notification generation. The result is a silent token exfiltration channel paired with privileged action replay.

Root Cause

The root cause is improper origin validation [CWE-346]. The server reconstructs its own public identity from request-supplied headers instead of a hardened allowlist or static configuration. Any client that can reach the HITL trigger endpoint can dictate the host used in outbound notification links.

Attack Vector

An unauthenticated attacker sends a request to a Heym endpoint that enqueues an anonymous HITL workflow. The request includes a forged Origin or X-Forwarded-Host header pointing to an attacker domain. Heym generates a reviewer notification containing a review URL built from the spoofed host and a valid capability token. When the legitimate reviewer opens the link, the browser transmits the token to the attacker. The attacker then replays the token against the real Heym instance to submit a decision executed with the owner's credentials. See the VulnCheck advisory for additional detail.

No verified exploit code is published. Refer to the GitHub Security Advisory GHSA-6rv3-wh25-7pg5 for vendor-supplied technical context.

Detection Methods for CVE-2026-105396

Indicators of Compromise

• Outbound HITL notification emails containing review URLs whose host does not match the organization's canonical Heym domain.
• HTTP requests to Heym workflow endpoints containing X-Forwarded-Host or Origin values that reference external, unknown, or newly registered domains.
• Capability token submissions originating from IP addresses or user agents that differ from the notified reviewer's normal access pattern.

Detection Strategies

• Parse Heym application logs and alert on any mismatch between the configured public hostname and the host used to render review URLs.
• Correlate inbound workflow-trigger requests with the outbound notification host to detect header-driven URL rewrites.
• Inspect reverse proxy and WAF logs for anonymous requests that set X-Forwarded-Host or Origin to non-allowlisted values.

Monitoring Recommendations

• Monitor DNS resolutions and TLS SNI telemetry for lookalike domains that could be used to host spoofed review pages.
• Track HITL decision submissions and flag any approval that arrives from a geolocation or ASN inconsistent with the assigned reviewer.
• Instrument alerting on the build_public_base_url() code path to log the resolved base URL for every notification generated.

How to Mitigate CVE-2026-105396

Immediate Actions Required

• Upgrade Heym to version 0.0.112 or later on all nodes that process HITL workflows.
• Rotate any capability tokens or signing secrets that may have been issued before the upgrade.
• Audit recent HITL decisions for approvals that may have been submitted by an attacker using a leaked token.

Patch Information

The vulnerability is fixed in Heym 0.0.112. The patch removes trust in client-controlled headers when assembling the public base URL. Review the GitHub Security Advisory GHSA-6rv3-wh25-7pg5 for upgrade guidance and the full list of changes.

Workarounds

• Configure the reverse proxy or load balancer to strip inbound X-Forwarded-Host and Origin headers from untrusted clients before they reach Heym.
• Enforce an allowlist of permitted hostnames at the proxy layer and reject requests whose host headers do not match.
• Disable anonymous HITL workflow triggers until the patched version is deployed.

# Example NGINX configuration to strip spoofable headers before Heym
location / {
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header Origin "";
    proxy_pass http://heym_upstream;
}