Heym CVE-2026-105396

Exploitation requires that the target Heym deployment (1) allows triggering anonymous/unauthenticated workflows, and (2) uses the HITL review feature that emails or notifies reviewers with links whose base URL is derived from client-supplied Origin or X-Forwarded-Host headers via build_public_base_url(). The attacker needs no authentication and no special privileges, but success depends on a legitimate reviewer actually clicking the attacker-controlled notification link (UI:P) - the token is not captured without that human action. Exploitation is further limited to instances running a version before 0.0.112 and to configurations where the application trusts these forwarding headers (typical behind misconfigured or absent reverse-proxy header sanitization).

This is a medium-severity (CVSS 4.0 base 5.3) origin-validation flaw (CWE-346) whose real-world risk is moderate and conditional rather than urgent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms a network-reachable, low-complexity, unauthenticated attack, but it critically requires passive user interaction (UI:P) - a legitimate reviewer must click the poisoned notification link - which caps impact and makes exploitation opportunistic rather than fully automatable. Impact is limited to low confidentiality and low integrity (VC:L/VI:L, no availability impact), reflecting capability-token capture and subsequent decision spoofing rather than full system compromise. No EPSS score, SSVC decision, KEV listing, or POC was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the signals that would elevate this to a priority (KEV, high EPSS, automatable=yes) are all absent. The dominant risk driver is the affected product's footprint: Heym is an obscure, pre-1.0 (v0.0.112) project, so even though the vulnerability chains to actions executed with owner credentials, the realistic exposure is small. Net: a legitimate but not high-priority issue for the few organizations running Heym; patch to 0.0.112, but it does not warrant emergency cross-fleet response.

An unauthenticated attacker triggers an anonymous Heym workflow while sending a forged Origin or X-Forwarded-Host header, causing build_public_base_url() to embed an attacker-controlled domain in the human-in-the-loop (HITL) reviewer notification. When a legitimate reviewer clicks the notification link, their capability token is delivered to the attacker's domain, and the attacker replays it to submit review decisions that execute with the owner's credentials. No public exploit code was identified at time of analysis.