CVE-2026-105396: Origin Validation Error in heymrun heym

CVE-2026-105396 describes a token leakage vulnerability in heym prior to version 0.0.112. The flaw exists in the build_public_base_url() function, where insufficient validation of Origin or X-Forwarded-Host headers allows unauthenticated attackers to redirect Human-In-The-Loop (HITL) review links. By spoofing these headers, attackers can trigger anonymous workflows that cause reviewer notifications to point to attacker domains. This enables attackers to capture capability tokens, which can then be used to submit decisions with the privileges of the owner.

The vulnerability allows unauthenticated attackers to redirect review links and capture tokens that grant the ability to submit decisions with owner-level credentials. This could lead to unauthorized actions being performed within the affected system, potentially compromising workflow integrity and security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor the vendor's official channels for updates and apply any official fixes once available. Until a patch is released, consider restricting or validating incoming Origin and X-Forwarded-Host headers where possible to mitigate exploitation risk.