CVE-2026-100859

Name of the Vulnerable Software and Affected Versions Heym versions prior to 0.0.106

Description An issue exists in the 'POST /api/credentials/test' endpoint that allows collaborators with shared credential access to exfiltrate the secret of the credential owner. An attacker can override the destination URL using the config parameter, causing the server to send decrypted authentication secrets to an external endpoint controlled by the attacker.

Recommendations Update to version 0.0.106 or later. Avoid using the config parameter in the 'POST /api/credentials/test' endpoint until the update is applied.