CVE-2026-105396 Heym before v0.0.112 HITL Review Token Leak via Spoofable Origin Header

Heym before v0.0.112 contains a token leakage vulnerability in buildpublicbaseurl that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to...

CVE-2026-105396 Heym before v0.0.112 HITL Review Token Leak via Spoofable Origin Header

Heym before v0.0.112 contains a token leakage vulnerability in buildpublicbaseurl that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to...

CVE-2026-105396

The Heym library (versions before v0.0.112 ) is vulnerable to a token leakage flaw within the build_public_base_url() function. An unauthenticated attacker can spoof Origin or X-Forwarded-Host headers to redirect HITL (Human-in-the-Loop) review links to an attacker-controlled domain. By triggerin...