Medium severity · published Sep 27, 2026
CVE-2026-100859
Heym before 0.0.106 Credential Exfiltration via URL Override
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the server to send decrypted authentication secrets to attacker-controlled endpoints.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HE
heym · heymrun
before 0.0.106 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-100859
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-100859
vendor-advisory
https://github.com/heymrun/heym/security/advisories/GHSA-39qx-wp7x-69rq
third-party-advisory
https://www.vulncheck.com/advisories/heym-before-0.0.106-credential-exfiltration-via-url-override
More from heym
8.8
CVE-2026-55376
heym Python Tool Sandbox Escape
8.8
CVE-2026-100865
Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape
8.8
CVE-2026-100864
heym before 0.0.91 Remote Code Execution via Expression Engine
8.8
CVE-2026-45227
Heym < 0.0.21 Sandbox Escape via Python Introspection
7.6
CVE-2026-45225
Heym < 0.0.21 Path Traversal File Upload via upload_file()