CVE-2026-101049

Heym before 0.0.53 Slack Webhook Signature Verification Bypass

Published Sep 27, 2026 CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Description

Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets. Remote unauthenticated attackers can send forged Slack events to known webhook URLs to trigger workflows with the owner's credentials.

Analysis

Technical impact

Heym versions before 0.0.53 do not verify Slack request signatures when trigger nodes either lack credential identifiers or have empty signing secrets. This vulnerability allows a remote, unauthenticated attacker to fabricate Slack events and post them to known webhook URLs. The forged requests are accepted as authentic, causing the application to execute the associated workflow using the owner's credentials, which can lead to arbitrary code execution or data exfiltration.

Affected Systems

Designated affected product is Heym from vendor Heymrun, specifically all releases prior to version 0.0.53.

Risk and Exploitability

The CVSS score of 8.3 classifies this flaw as high severity, and the EPSS metric is currently unavailable, implying no known widespread exploitation yet. It is not listed in CISA KEV. Attack paths rely on sending crafted HTTP requests to the Slack webhook endpoint, requiring no prior authentication or privileged access. Once leveraged, the attacker gains control over workflows running under the legitimate owner's environment.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

heymrun

heym

unaffected

Version	Status	Constraints
`0`	affected	< 0.0.53
`0.0.53`	unaffected	—

No data.

Vendor Product Versions

Heymrun

Heym

Version	Status	Scheme	Platform
`[0,0.0.53)`	affected	generic	—
`0.0.53`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the official Heym 0.0.53 update or a later version that fixes signature verification.
Disable or remove any trigger nodes that lack credential IDs or configure them with non‑empty signing secrets.
If the patch cannot be applied immediately, enforce network‑level filtering to block or validate Slack IP ranges or implement additional verification before accepting webhook events.

Generated by OpenCVE AI on September 27, 2026 at 17:23 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.380% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/heymrun/heym/commit/341d1012367cd74f85c617e1c98dd49e3fcb5e83
https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h
https://www.vulncheck.com/advisories/heym-before-0.0.53-slack-webhook-signature-verification-bypass

History

Sep 28, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 27, 2026 6:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Heymrun Heymrun heym
Vendors & Products		Heymrun Heymrun heym

Sep 27, 2026 4:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets. Remote unauthenticated attackers can send forged Slack events to known webhook URLs to trigger workflows with the owner's credentials.
Title		Heym before 0.0.53 Slack Webhook Signature Verification Bypass
Weaknesses		CWE-287
References		https://github.com/heymrun/heym/commit/341d1012367cd74f85c617e1c98dd49e3fcb5e83 https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h https://www.vulncheck.com/advisories/heym-before-0.0.53-slack-webhook-signature-verification-bypass
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N'}` cvssV4_0 `{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N'}`