The flaw occurs because heym's Redis node workflow does not properly handle failed credential lookups, treating a missing or unauthorized credential as a default empty configuration and falling back to localhost:6379 with default settings. As a result, an authenticated workflow author can supply a credential ID that they do not own or that has been deleted, thereby gaining a read/write connection to the Redis instance running on the system's loopback interface. This yields unauthorized access to data stored in Redis and potential modification of data. Another consequence is that if the deployment does not have a Redis server, the user receives a misleading connection error that can be exploited to infer system state. The weakness is classified as CWE‑636, which covers improper handling of authentication errors.

heym by heymrun, any installation that uses the default Redis node workflow and runs a version older than 0.0.105. The flaw affects all releases prior to 0.0.105, including the default docker‑compose.yml that ships with the project, which does not include a Redis container but remains vulnerable if the application is configured to use Redis on localhost.

The vulnerability has a medium to high impact CVSS score of 6.8 and the EPSS score is currently listed as not available. Because it requires an authenticated workflow author who can supply an arbitrary credential ID, the risk to external attackers is limited unless they first gain such credentials or have an account with workflow author privileges. Potential exploitation would allow the attacker to read or modify any data served by the Redis instance listening on the host, which can contain sensitive state information used by the application. Since the flaw is not listed in the CISA KEV catalog, there have been no identified public exploits at this time, but the code path is straightforward and could be abused if an attacker can authenticate to the service.