Heym versions before 0.0.113 allow former collaborators to continue executing JWT‑authenticated workflows by reusing scoped "workflow:execute" tokens after a share has been removed. The vulnerability permits minting of a token with a time‑to‑live of up to ten years, a token that the owner can neither list nor revoke. An attacker can repeatedly invoke the workflow, thereby consuming credentials that should have been revoked and performing actions as the original collaborator.

Heymrun’s Heym application, versions 0.0.5 through 0.0.112, is affected. The vulnerability exists in the workflow execution token handling logic of those releases.

The CVSS score of 5.3 indicates moderate severity, and the vulnerability is not currently listed in CISA’s KEV catalog. EPSS information is not available, so the likelihood of exploitation cannot be quantified precisely. The attack requires that the attacker has previously been a collaborator and that the share removal has occurred, after which the attacker can generate a long‑lived token and repeatedly trigger the workflow. Once executed, the workflow can access any resources tied to the removed share.