HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with… (CVE-2026-82291)

The vulnerability in HeyForm prior to version 3.0.0-rc.8 involves insecure handling of CORS headers. The application reflects the Origin header from incoming requests in its CORS response while simultaneously allowing credentials (cookies, HTTP authentication). This combination violates the Same-Origin Policy, enabling attackers to perform cross-origin requests that carry the victim's authentication context. Consequently, attackers can execute authenticated GraphQL queries to access or modify sensitive user data and account configurations.

Successful exploitation allows attackers to bypass same-origin restrictions and perform authenticated actions on behalf of logged-in users. This can result in unauthorized disclosure of sensitive data such as workspace contents, projects, forms, submissions, and respondent data, as well as unauthorized modification of account settings. The vulnerability does not impact availability but has high confidentiality and integrity impact.

No official patch or fix is currently documented. Since the vulnerability is due to improper CORS configuration, remediation involves updating HeyForm to version 3.0.0-rc.8 or later where this issue is resolved. Until a fix is applied, administrators should consider disabling cross-origin requests with credentials or implementing strict CORS policies that do not reflect arbitrary Origin headers. Monitor vendor advisories for official patches or updates.