Description
Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execute actions on attacker-supplied input.
Published: 2026-09-27
Score: 8.3 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution via unauthorized workflow triggers
Action: Immediate Patch
AI Analysis

Impact

Heym before 0.0.53 fails to validate the X‑Telegram‑Bot‑Api‑Secret‑Token header on webhook endpoints when credential_id is missing or secret_token is empty. An attacker can send forged Telegram updates that bypass authentication, causing the application to execute workflows with the owner’s credentials and run attacker‑supplied actions.

Affected Systems

Vendors: heymrun’s Heym application. All releases prior to version 0.0.53 are affected. No further patch or version information is provided beyond the stated cutoff.

Risk and Exploitability

With a CVSS score of 8.3, this flaw poses high severity. While no EPSS score is reported and it is not currently listed in CISA KEV, the vulnerability can be exploited remotely over the internet via the Telegram webhook interface. Attackers who can reach the webhook endpoint can trigger arbitrary actions without authentication, potentially compromising the system’s integrity and confidentiality.

Generated by OpenCVE AI on September 27, 2026 at 17:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Heym 0.0.53 or later to receive the authentication check fix.
  • If upgrading is not immediately possible, restrict access to the webhook URL to the IP addresses of your trusted network or implement an additional shared secret that validates incoming requests.
  • Rotate any bot or workflow credentials that may have been exposed through forged updates and audit workflow logs for abnormal activity.

Generated by OpenCVE AI on September 27, 2026 at 17:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 27 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Heymrun
Heymrun heym
Vendors & Products Heymrun
Heymrun heym

Sun, 27 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execute actions on attacker-supplied input.
Title Heym before 0.0.53 Authentication Bypass via Telegram Webhook
Weaknesses CWE-287
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N'}

cvssV4_0

{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Heymrun Heym
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-28T13:14:37.706Z

Reserved: 2026-09-27T15:48:49.472Z

Link: CVE-2026-101050

cve-icon Vulnrichment

Updated: 2026-09-28T13:14:33.662Z

cve-icon NVD

Status : Deferred

Published: 2026-09-27T17:16:56.100

Modified: 2026-09-28T20:57:50.143

Link: CVE-2026-101050

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-27T17:45:12Z

Weaknesses