CVE-2026-109362: Insufficient Session Expiration in heymrun heym
Description
Heym versions from 0.0.5 up to but not including 0.0.113 have a broken access control vulnerability that allows former collaborators to continue executing JWT-authenticated workflows by reusing scoped workflow:execute tokens after their share has been removed. These tokens can be minted with a time-to-live (TTL) of up to 10 years, and the token owner cannot list or revoke them, enabling repeated unauthorized workflow execution using shared credentials.
CVSS v4.0
Score 5.3medium
Affected software
heymrun
heym
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-109362 describes an insufficient session expiration vulnerability in Heym prior to version 0.0.113. The flaw allows former collaborators to reuse scoped workflow:execute JWT tokens even after their access share has been revoked. These tokens can have a TTL of up to 10 years, and there is no mechanism for the owner to list or revoke these tokens, resulting in persistent unauthorized execution of workflows that consume shared credentials.
Potential Impact
Attackers who were formerly collaborators can maintain unauthorized access to execute workflows indefinitely by reusing long-lived JWT tokens. This undermines access control and session management, potentially allowing unauthorized workflow execution and misuse of shared credentials without detection or revocation capability.
Mitigation Recommendations
A fix is available in Heym version 0.0.113 and later. Users should upgrade to version 0.0.113 or newer to remediate this vulnerability. Until then, there is no known method to revoke or list the long-lived tokens, so removing former collaborators alone does not prevent token reuse.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-12T14:21:32.594Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acd0c192cdf04f656b11c17
Added to database: 10/12/2026, 16:34:33 UTC
Last enriched: 10/12/2026, 16:48:52 UTC
Last updated: 10/12/2026, 21:46:38 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.