CVE-2026-101050

Heym before 0.0.53 Authentication Bypass via Telegram Webhook

Published Sep 27, 2026 CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Description

Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execute actions on attacker-supplied input.

Analysis

Technical impact

Heym before 0.0.53 fails to validate the X‑Telegram‑Bot‑Api‑Secret‑Token header on webhook endpoints when credential_id is missing or secret_token is empty. An attacker can send forged Telegram updates that bypass authentication, causing the application to execute workflows with the owner’s credentials and run attacker‑supplied actions.

Affected Systems

Vendors: heymrun’s Heym application. All releases prior to version 0.0.53 are affected. No further patch or version information is provided beyond the stated cutoff.

Risk and Exploitability

With a CVSS score of 8.3, this flaw poses high severity. While no EPSS score is reported and it is not currently listed in CISA KEV, the vulnerability can be exploited remotely over the internet via the Telegram webhook interface. Attackers who can reach the webhook endpoint can trigger arbitrary actions without authentication, potentially compromising the system’s integrity and confidentiality.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

heymrun

heym

unaffected

Version	Status	Constraints
`0`	affected	< 0.0.53
`0.0.53`	unaffected	—

No data.

Vendor Product Versions

Heymrun

Heym

Version	Status	Scheme	Platform
`[0,0.0.53)`	affected	generic	—
`0.0.53`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Heym 0.0.53 or later to receive the authentication check fix.
If upgrading is not immediately possible, restrict access to the webhook URL to the IP addresses of your trusted network or implement an additional shared secret that validates incoming requests.
Rotate any bot or workflow credentials that may have been exposed through forged updates and audit workflow logs for abnormal activity.

Generated by OpenCVE AI on September 27, 2026 at 17:22 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.380% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/heymrun/heym/commit/341d1012367cd74f85c617e1c98dd49e3fcb5e83
https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h
https://www.vulncheck.com/advisories/heym-before-0.0.53-authentication-bypass-via-telegram-webhook

History

Sep 28, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 27, 2026 6:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Heymrun Heymrun heym
Vendors & Products		Heymrun Heymrun heym

Sep 27, 2026 4:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execute actions on attacker-supplied input.
Title		Heym before 0.0.53 Authentication Bypass via Telegram Webhook
Weaknesses		CWE-287
References		https://github.com/heymrun/heym/commit/341d1012367cd74f85c617e1c98dd49e3fcb5e83 https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h https://www.vulncheck.com/advisories/heym-before-0.0.53-authentication-bypass-via-telegram-webhook
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N'}` cvssV4_0 `{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N'}`