CVE-2026-105396 heymrun CVE debrief

Who should care

Defenders responsible for the security of Heym applications should assess exposure and prioritize patching to prevent potential token leakage. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify the version of Heym in use and apply patches as necessary to prevent token leakage.

Why it matters

CVE-2026-105396 is a token leakage vulnerability in Heym application before version 0.0.112 that allows unauthenticated attackers to redirect HITL review links and potentially capture capability tokens. Defenders should prioritize verifying the version of Heym in use and applying patches to prevent potential token leakage.

• Potential capture of capability tokens to submit decisions executed with owner credentials
• Redirect of HITL review links by spoofing Origin or X-Forwarded-Host headers
• Verification of Heym version and application of patches to prevent token leakage

Technical summary

The build_public_base_url() function in Heym before version 0.0.112 is vulnerable to token leakage due to improper handling of Origin or X-Forwarded-Host headers. This allows unauthenticated attackers to redirect HITL review links and potentially capture capability tokens. Affected product deployments should be identified and patched to prevent potential token leakage. Defenders should prioritize verifying the version of Heym in use and applying the necessary patches to prevent potential token leakage. The vulnerability impacts systems using Heym before version 0.0.112.

Defensive priority

Defenders should prioritize verifying the version of Heym in use and applying the necessary patches to prevent potential token leakage.

Recommended defensive actions

• Verify the version of Heym in use and apply patches as necessary
• Monitor for suspicious activity related to HITL review links
• Consider implementing additional security measures to protect capability tokens
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source references provide information on the vulnerability, but further verification is needed to determine the full scope of affected systems and potential impact. Affected systems likely include those using Heym before version 0.0.112. Defenders should verify the version of Heym in use and assess exposure to potential token leakage.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.