Executive brief
Heym is a credential management platform that allows teams to securely store and share authentication secrets. A flaw in the credential testing endpoint allows a collaborator with legitimate access to a shared credential to steal the credential owner's authentication secret by redirecting the test request to an attacker-controlled server. This enables unauthorized disclosure of sensitive credentials like API tokens and passwords.
Technical details
The POST /api/credentials/test endpoint improperly validates configuration overrides, allowing an authenticated collaborator to merge caller-supplied config (including a malicious base_url) with a shared credential before testing the connection. The endpoint then sends the decrypted credential's authentication secret to the attacker-specified URL via integrations like Jira and Supabase. An attacker must have legitimate shared access to a credential and network access to call the endpoint.
Affected products
- heymrun Heym before 0.0.106
Timeline
- 2026-09-05: disclosed: GitHub security advisory published
- 2026-09-05: patched: Fix released in version 0.0.106