CVE-2026-100859
Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST…
- Risk score
- 42/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 27 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the server to send decrypted a…
- Affected
- See advisory
- Fix
- Upgrade the product to 0.0.106 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
References
Original description
Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the server to send decrypted authentication secrets to attacker-controlled endpoints.
Last activity 27 Sep 2026. Patch Forecast updates every hour.