CVE-2026-109362
Heym v0.0.5 before v0.0.113 Broken Access Control via Workflow Execution Tokens
Published Oct 12, 2026 · updated Oct 15, 2026 · heymrun heym
Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner cannot list or revoke, and repeatedly run the workflow consuming shared credentials.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 12, 2026 · NIST NVD
Detected
Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner cannot list or revoke, and repeatedly run the workflow consuming shared credentials.
Oct 15, 2026 · NIST NVD
Updated
Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner cannot list or revoke, and repeatedly run the workflow consuming shared credentials.
Affected
- vendor heymrun heymversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-109362
Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner ca
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-109362
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-109362
30-day exploitation probability 0.2%
first.org - NIST NVDVulnerability recordCVE-2026-109362
Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner ca
nvd.nist.gov