Executive brief
Heym is a workflow automation platform that integrates with messaging services like Telegram. An authentication flaw in its Telegram webhook endpoint allows attackers to forge webhook requests without valid credentials, enabling them to trigger workflows and execute actions using the owner's configured credentials and permissions.
Technical details
The Telegram webhook endpoint skips X-Telegram-Bot-Api-Secret-Token verification when credential_id is absent or secret_token is empty, allowing unauthenticated POST requests to trigger workflows. An attacker with knowledge of the public webhook URL can inject forged Telegram updates to execute arbitrary workflow actions on attacker-controlled input. The fix (version 0.0.53) enforces fail-closed behavior by rejecting such requests with a 400 error.
Affected products
- heymrun Heym before 0.0.53
Timeline
- 2026-06-26: disclosed
- 2026-06-26: patched