MEDIUM 5.3 NVD
CVE-2026-109362
Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scop
Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner cannot list or revoke, and repeatedly run the workflow consuming shared credentials.
References
- https://github.com/heymrun/heym/security/advisories/GHSA-pwr6-6377-3cgv
- https://www.vulncheck.com/advisories/heym-0.0.5-before-0.0.113-broken-access-control-via-w
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-12 via NVD.
vulnfeed aggregates 10929 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.