CVE-2026-82291

Name of the Vulnerable Software and Affected Versions HeyForm versions prior to 3.0.0-rc.8

Description The software reflects the request Origin header in Cross-Origin Resource Sharing (CORS) responses while allowing credentials. This configuration enables authenticated cross-origin requests, allowing attackers to execute authenticated GraphQL queries from malicious pages visited by logged-in users. This can lead to unauthorized access to workspaces, projects, forms, submissions, and respondent data, or the modification of account settings.

Recommendations Update to version 3.0.0-rc.8 or later.