CVE-2026-109362: Heym Auth Bypass Vulnerability

CVE-2026-109362 Overview

CVE-2026-109362 is a broken access control vulnerability in Heym versions v0.0.5 through v0.0.113. The flaw allows former collaborators to continue executing JSON Web Token (JWT) authenticated workflows after their share access has been revoked. Attackers mint workflow:execute tokens with a time-to-live up to 10 years before revocation. The workflow owner cannot list or revoke these tokens, enabling continued consumption of shared credentials by unauthorized parties. The vulnerability is tracked as CWE-613: Insufficient Session Expiration.

Critical Impact
Former collaborators retain persistent execution access to workflows and shared credentials even after share removal, with no owner-side visibility or revocation path.

Affected Products

Heym v0.0.5 through v0.0.112
Fixed in Heym v0.0.113
Deployments using scoped workflow:execute JWT tokens for collaborator access

Discovery Timeline

2026-10-12 - CVE-2026-109362 published to the National Vulnerability Database (NVD)
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109362

Vulnerability Analysis

The vulnerability resides in Heym's workflow sharing and token issuance logic. When a user is added as a collaborator, Heym issues a scoped JWT with the workflow:execute claim. The token supports a configurable time-to-live of up to 10 years. When the owner removes the collaborator's share, Heym revokes the collaborator's interactive access but does not invalidate previously minted execution tokens.

The owner has no interface to enumerate outstanding tokens tied to their workflows. Without a server-side revocation list or token binding to active share membership, the signed JWT remains valid until its embedded expiration. A former collaborator can replay the token against the execution endpoint and run the workflow, consuming shared API keys, OAuth secrets, and other credentials embedded in the workflow definition.

Root Cause

The root cause is insufficient session expiration tied to authorization state (CWE-613). Heym treats JWT signature validity and the embedded exp claim as sufficient proof of authorization. It does not re-check that the subject still holds share rights on the referenced workflow at execution time. Access control decisions are made at token issuance rather than at token use.

Attack Vector

Exploitation requires the attacker to have been a legitimate collaborator at some prior point and to have minted a long-lived workflow:execute token during that window. After share removal, the attacker sends authenticated HTTP requests to the workflow execution endpoint using the retained JWT. Each successful call runs the workflow with the owner's provisioned credentials. The attack vector is network-based and requires low privileges and no user interaction. The vulnerability affects confidentiality and integrity of workflow data and consumes third-party resources tied to the owner's credentials.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-pwr6-6377-3cgv and the VulnCheck Advisory on Broken Access Control for additional technical detail.

Detection Methods for CVE-2026-109362

Indicators of Compromise

Workflow execution events authenticated by JWTs whose subject is no longer a current collaborator on the target workflow.
JWTs presented to the execution API with exp claims set years in the future, particularly tokens issued before a share removal event.
Unexpected consumption of workflow-bound credentials, API quotas, or third-party service calls originating from automated workflow runs.

Detection Strategies

Correlate workflow execution logs against the current share membership table and alert when the token subject is absent.
Parse JWT claims from authentication logs and flag workflow:execute tokens with TTLs exceeding operational norms (for example, 90 days).
Baseline execution frequency per workflow and alert on anomalous invocation volume following any collaborator removal event.

Monitoring Recommendations

Centralize Heym application and audit logs into a security data lake for retention and cross-source correlation.
Monitor outbound API usage from workflows for credential abuse patterns such as data exfiltration or billing anomalies.
Review share removal events and immediately audit subsequent workflow execution activity from the removed principal.

How to Mitigate CVE-2026-109362

Immediate Actions Required

Upgrade Heym to v0.0.113 or later across all environments.
Rotate every credential, API key, and OAuth secret stored in or referenced by Heym workflows that were shared at any point.
Audit the full history of workflow shares and identify every principal who held workflow:execute access before the upgrade.
Invalidate the active JWT signing key where supported to force reissuance of all workflow execution tokens.

Patch Information

The vulnerability is fixed in Heym v0.0.113. The patch is described in the GitHub Security Advisory GHSA-pwr6-6377-3cgv. Operators should validate that the fixed version re-checks share membership at execution time and provides a token revocation interface.

Workarounds

Restrict workflow:execute token TTLs to the shortest operationally acceptable value until the upgrade is deployed.
Remove shared workflow collaborators and rotate associated credentials when a share relationship ends.
Place Heym behind a reverse proxy that enforces short-lived access tokens and validates subject membership on each execution request.

bash

# Configuration example
# Upgrade Heym to the fixed release
npm install heym@0.0.113

# After upgrade, rotate the JWT signing secret to invalidate outstanding tokens
export HEYM_JWT_SECRET="$(openssl rand -hex 64)"

# Restart the Heym service to apply the new signing key
systemctl restart heym