HeyForm CVE-2026-82291

A logged-in HeyForm user must actively visit an attacker-controlled web page while holding a valid HeyForm session cookie - this is the user-interaction prerequisite captured by UI:R in the CVSS vector. The HeyForm server must be reachable from the victim's browser (not restricted to localhost or a VPN-only network). No non-default configuration is required: the vulnerable origin: true, credentials: true combination was the default out-of-the-box CORS setting in all releases before 3.0.0-rc.8. Limiting factors include: the requirement for social engineering to direct a logged-in user to the malicious page; the session cookie's SameSite=Lax attribute, which prevents exploitation via top-level navigations but does NOT prevent cross-origin fetch/XMLHttpRequest from embedded attacker pages; and the need to know or guess the target HeyForm instance URL.

The vendor-assigned CVSS 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) is well-calibrated: the flaw is network-exploitable with low complexity and no required privileges, but mandates user interaction (UI:R) because a logged-in victim must be lured to an attacker-controlled page. The unchanged scope (S:U) reflects that exploitation operates within the victim's existing HeyForm session context rather than pivoting to other systems. Real-world risk is meaningful for self-hosted deployments where users maintain long-lived sessions - a common pattern for internal teams. The session cookie is HttpOnly and SameSite=Lax; however, SameSite=Lax does not block cross-origin fetch/XMLHttpRequest calls from embedded attacker pages, so it does not mitigate this flaw. No EPSS score was provided in the input data, no KEV listing exists, and no POC is identified, so opportunistic or automated exploitation is not confirmed. The social engineering prerequisite (phishing a logged-in user) moderately limits mass exploitation but does not eliminate targeted risk against high-value deployments.

An attacker registers a malicious domain and embeds JavaScript that issues fetch requests with credentials: 'include' to the victim organization's HeyForm instance at its known URL. The attacker sends a phishing link to a HeyForm user with an active session; when the user's browser loads the page, it automatically attaches the HeyForm session cookie to the cross-origin GraphQL queries, the server reflects the malicious page's origin and permits the credentialed response, and the attacker reads back form submissions or modifies the victim's account settings. No POC has been identified at time of analysis, but the attack requires only standard browser fetch APIs.