CVE-2026-109362

CVSS 5.4 (medium) · published 2026-10-12

Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner cannot list or revoke, and repeatedly run the workflow consuming shared credentials.

Weakness: CWE-613

Source: NVD CVE-2026-109362

References

• https://github.com/heymrun/heym/security/advisories/GHSA-pwr6-6377-3cgv
• https://www.vulncheck.com/advisories/heym-0.0.5-before-0.0.113-broken-access-control-via-workflow-execution-tokens
• https://github.com/heymrun/heym/security/advisories/GHSA-pwr6-6377-3cgv

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.