CVE-2026-105396

Executive Summary

CVE-2026-105396 is a token leakage vulnerability in Heym versions prior to v0.0.112, residing in the build_public_base_url() function. An unauthenticated attacker can spoof Origin or X-Forwarded-Host headers to redirect HITL (human-in-the-loop) review links, causing reviewer notifications to point to attacker-controlled domains. This allows the attacker to capture capability tokens and submit decisions that are executed with the workflow owner's credentials, impacting confidentiality and integrity with a CVSS base score of 5.4.

Technical Analysis

The vulnerability is classified as CWE-346: Origin Validation Error. The core issue lies in how Heym constructs public-facing URLs for human-in-the-loop review links. The build_public_base_url() function fails to properly validate the incoming Origin or X-Forwarded-Host headers, trusting them to determine the base URL for review links. In a typical deployment, Heym likely uses these headers to generate absolute URLs for notifications sent to reviewers. An attacker can send a request to trigger an anonymous workflow, injecting a forged Origin or X-Forwarded-Host header. As a result, the generated review link points to a domain controlled by the attacker instead of the legitimate Heym instance.

When a reviewer receives the notification and clicks the link, they are directed to the attacker's domain. The capability token embedded in the URL is then captured by the attacker. This token is used to authenticate the reviewer's decision submission. Because the token is tied to the workflow owner's credentials (likely via a delegated capability system), the attacker can submit arbitrary decisions that are executed with the owner's privileges. The attack does not require authentication and relies on user interaction (the reviewer clicking the link), but the attacker can trigger the workflow anonymously.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) indicates a network-based attack, low complexity, no privileges required, and user interaction required. The scope is unchanged, and the impact is limited to low confidentiality and integrity, with no availability impact. This aligns with the ability to capture tokens and submit decisions, potentially leading to unauthorized actions but not affecting system availability.

The exact implementation details of build_public_base_url() are not provided, but the vulnerability class is clear: origin validation error leading to token leakage and redirection. No public proof-of-concept or exploit code is available, and no Nuclei template exists. The vulnerability is unpatched, with no vendor fix or workaround documented.

Exploitation Scenarios

1. Reconnaissance/target identification: The attacker identifies a Heym instance running a version before v0.0.112. This can be done by scanning for Heym-specific endpoints or headers, or by knowing the target's use of Heym for workflow management.

2. Triggering the flaw: The attacker sends a request to an anonymous workflow endpoint (the exact endpoint is not specified in the description). This request includes a forged Origin or X-Forwarded-Host header pointing to an attacker-controlled domain. Since the workflow is anonymous, no authentication is required. The build_public_base_url() function uses the forged header to construct the base URL for the review link.

3. Payload/execution method: The attacker does not need a complex payload; the forged header itself is the attack vector. The request triggers the generation of a review notification containing a link with the attacker's domain. The notification is sent to a legitimate reviewer (e.g., via email or another channel). The attacker must ensure the reviewer clicks the link. No specific payload is required beyond the header manipulation.

4. Post-exploitation impact: When the reviewer clicks the link, the capability token is sent to the attacker's domain (e.g., via the URL path or query parameter). The attacker captures the token and can then submit a decision to the Heym instance, impersonating the reviewer. Because the token is associated with the workflow owner's credentials, the decision is executed with the owner's privileges. This could lead to unauthorized workflow state changes, data modification, or further lateral movement within the Heym environment.

No public PoC is available; the attack chain is inferred from the vulnerability class and description.

Impact Assessment

The CVSS base score is 5.4 (Medium), with low confidentiality and integrity impact. The attack requires user interaction (the reviewer clicking the link), which somewhat limits its exploitability. However, in environments where Heym is used for critical human-in-the-loop workflows (e.g., approval processes, content moderation, or automated decision-making), the impact can be significant. An attacker could manipulate decisions, approve malicious content, or alter workflow outcomes, potentially leading to data integrity issues, reputational damage, or financial loss.

The blast radius depends on the number of workflows and the privileges of the owner. If the owner has broad permissions, the attacker could chain this to further compromise. The lack of authentication required for triggering the workflow makes it easier to initiate, but the need for a reviewer to click the link adds a social engineering element. The vulnerability affects all Heym versions before v0.0.112.

Detection Guidance

Sigma Rule

title: Heym Origin Header Spoofing for Token Leakage
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to spoof Origin or X-Forwarded-Host headers in requests to Heym, potentially leading to token leakage.
author: Threat Intelligence
date: 2026-05-12
logsource:
  category: web
  product: heym
detection:
  selection:
    cs-method: 'POST'
    cs-uri-query|contains: 'workflow'
    cs-headers|contains:
      - 'Origin: '
      - 'X-Forwarded-Host: '
  condition: selection
falsepositives:
  - Legitimate reverse proxy configurations
level: high

YARA Rule

rule Heym_Token_Leakage_Header_Spoofing
{
    meta:
        description = "Detects HTTP requests with spoofed Origin or X-Forwarded-Host headers targeting Heym"
        author = "Threat Intelligence"
        date = "2026-05-12"
        reference = "CVE-2026-105396"
    strings:
        $origin = "Origin: " nocase
        $xforwarded = "X-Forwarded-Host: " nocase
        $heym = "Heym" nocase
    condition:
        any of ($origin, $xforwarded) and $heym
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105396 Heym Origin Header Spoofing Attempt"; flow:to_server; content:"Origin|3a|"; http_header; content:"Heym"; http_header; sid:1000001; rev:1;)

Elastic Detection

sequence by host.id
  [network where network.protocol == "http" and http.request.method == "POST" and
   http.request.headers contains "Origin" and
   http.request.headers contains "X-Forwarded-Host" and
   http.request.headers contains "Heym"]

Splunk SPL Query

index=web sourcetype=access_combined
| search (cs_headers="*Origin:*" OR cs_headers="*X-Forwarded-Host:*") AND (cs_uri_query="*workflow*" OR cs_uri_path="*workflow*")
| table _time, src_ip, cs_uri_path, cs_headers

Wazuh OSSEC Rule

<group name="heym,">
  <rule id="100001" level="10">
    <decoded_as>json</decoded_as>
    <field name="http.request.headers">\.*Origin:.*|\.*X-Forwarded-Host:.*</field>
    <description>Heym Origin or X-Forwarded-Host header spoofing detected (CVE-2026-105396)</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Validate and sanitize the Origin and X-Forwarded-Host headers at the reverse proxy or load balancer level, allowing only trusted domains.
   • Disable anonymous workflow triggers if not essential, or require authentication for triggering workflows.
   • Implement strict Content Security Policy (CSP) and referrer policies to limit token leakage.
   • Educate reviewers to verify the domain of review links before clicking.

2. Patch/upgrade steps:

   • Monitor the Heym project for a security patch. Since no patch is currently available, consider upgrading to a version after v0.0.112 once released.
   • If a patch becomes available, apply it immediately and verify that build_public_base_url() properly validates headers.

3. Long-term hardening:

   • Adopt a whitelist approach for header-based URL construction, never trusting client-supplied headers.
   • Implement token binding to the original reviewer's session or IP address to prevent token reuse.
   • Regularly audit workflow systems for similar origin validation errors.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105396
• CWE-346: https://cwe.mitre.org/data/definitions/346.html
• Heym project repository (if available): https://github.com/heym (placeholder based on product name)
• No known threat actor campaigns or exploit-in-the-wild evidence at this time.
• CISA KEV: Not listed.