Threats tagged 'ghsa-33w4-w3j3-cmvg'

Heym versions before 0.0.106 have a vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. This occurs because attackers can override the destination URL in the config parameter, causing the server to send decrypted authentication secrets to attacker-controlled endpoints.