Executive brief
Heym is a workflow automation platform that integrates with services like Slack and Telegram. When Slack trigger nodes are configured without credential IDs or have empty signing secrets, the webhook endpoint skips signature verification entirely. An attacker with the public webhook URL can forge Slack events to trigger workflows with the owner's privileges, such as sending messages, modifying data, or executing connected actions.
Technical details
The Slack webhook endpoint in backend/app/api/slack.py fails to validate request signatures when the trigger node lacks a credentialId or the signing_secret is empty, allowing unauthenticated attackers to craft POST requests to known webhook URLs that bypass authentication. The vulnerability is reachable when workflow trigger nodes are misconfigured at creation time or remain in a degraded state. The patch (version 0.0.53) now rejects such requests with a 400 response and validates credential configuration before signature checking.
Affected products
- heymrun Heym before 0.0.53
Timeline
- 2026-06-26: disclosed
- 2026-06-26: patched