# CVE-2026-105396: Heym token leakage in HITL review links via header spoofing

Source: https://junglewise.ai/threats/cve-2026-105396-heym-before-v0-0-112-contains-a-token-leakage-vulnerability-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105396 · Severity: medium · CVSS 5.4 · Published 2026-10-05

Heym is a workflow automation platform that supports human-in-the-loop review tasks for agent decisions. An attacker can forge HTTP headers to redirect reviewer notification links to attacker-controlled domains, capturing capability tokens that grant full access to approve, reject, or modify workflow decisions with the workflow owner's credentials. This requires the workflow to be publicly triggered (via webhook or API) and the reviewer to click a malicious link.

Technologies: [Heymrun Heym](https://junglewise.ai/threats/technologies/heym). Vendors: [Heymrun](https://junglewise.ai/threats/vendors/heymrun).

## Quick answers

**Is CVE-2026-105396 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105396 being exploited in the wild.

**How severe is CVE-2026-105396?** Medium severity, with a CVSS score of 5.4, published 5 October 2026.

**Which products and versions are affected?** Heymrun Heym before 0.0.112.

**Is there a fix for CVE-2026-105396?** Yes: fixed in 0.0.112. Until then: Disable or restrict anonymous workflow triggers if human-in-the-loop review is not required. Deploy behind a reverse proxy that normalizes or validates Origin and X-Forwarded-Host headers against a CORS allowlist before they reach the application. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105396 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-105396?** Check whether you run Heymrun Heym at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.0.112

Disable or restrict anonymous workflow triggers if human-in-the-loop review is not required. Deploy behind a reverse proxy that normalizes or validates Origin and X-Forwarded-Host headers against a CORS allowlist before they reach the application.

## Technical details

The build_public_base_url() function in backend/app/services/hitl_service.py trusts the Origin or X-Forwarded-Host request headers to construct HITL review URLs that embed a capability token. An unauthenticated attacker triggering an anonymous workflow can set a forged Origin header; the resulting review URL embedded in notifications points to an attacker domain instead of the legitimate server, capturing the token. Once captured, the attacker can submit decisions (accept, edit, refuse) that execute with the workflow owner's stored credentials and global variables, potentially triggering downstream actions or data exfiltration.

## Affected products

- heymrun Heym before 0.0.112

## Timeline

- 2026-09-20: disclosed
- 2026-10-05: advisory

## References

- [https://github.com/heymrun/heym/security/advisories/GHSA-6rv3-wh25-7pg5](https://github.com/heymrun/heym/security/advisories/GHSA-6rv3-wh25-7pg5)
- [https://www.vulncheck.com/advisories/heym-before-0.0.112-hitl-review-token-leak-via-spoofable-origin-header](https://www.vulncheck.com/advisories/heym-before-0.0.112-hitl-review-token-leak-via-spoofable-origin-header)

## Related threats

- [Heym privilege escalation via error_workflow_id field](https://junglewise.ai/threats/cve-2026-110873-heym-from-0-0-55-before-0-0-121-contains-a-privilege-escalation)
- [Heym Telegram webhook auth bypass](https://junglewise.ai/threats/cve-2026-101050-heym-before-0-0-53-fails-to-verify-the-x-telegram-bot-api-secret)
- [Heym authentication bypass in Slack webhook verification](https://junglewise.ai/threats/cve-2026-101049-heym-before-0-0-53-fails-to-verify-slack-request-signatures-when)
- [Heym multiple RCE and authentication bypass vulnerabilities](https://junglewise.ai/threats/cve-2026-100865-heym-before-0-0-53-contains-multiple-independent-vulnerabilities)
- [heym SSRF in credential-supplied base URLs](https://junglewise.ai/threats/cve-2026-100861-heym-before-0-0-105-fails-to-apply-egress-guards-to-integration)