CVE-2026-109362
Deferred Deferred - Pending Action

Heym JWT Token Reuse After Share Removal

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner cannot list or revoke, and repeatedly run the workflow consuming shared credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109362
EUVD
EUVD-2026-97664

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
heymrun heym 0.0.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Heym v0.0.5 to v0.0.112 has a broken access control flaw where former collaborators can keep using JWT-auth workflow tokens even after their access is removed. These tokens have a TTL up to 10 years and cannot be listed or revoked by the owner. The system fails to check if the token minter still has access during execution, allowing unauthorized workflow runs and shared credential consumption.

Detection Guidance

Check if any workflow:execute tokens exist with long TTLs (up to 10 years) in heym versions <=0.0.112. Inspect token validation logs for the validate_workflow_auth function bypass. Look for unauthorized workflow executions by former collaborators.

Impact Analysis

Attackers or former collaborators could repeatedly execute workflows, consuming shared resources and credentials. Since tokens remain valid for years and are untrackable by owners, this leads to unauthorized actions, potential data leaks, and resource exhaustion without detection.

Compliance Impact

This vulnerability likely violates compliance requirements for access control and session management in GDPR (data protection) and HIPAA (health data). Unauthorized workflow execution risks data breaches, improper access logging, and inability to enforce timely revocation, leading to potential regulatory penalties.

Mitigation Strategies

Upgrade heym to version 0.0.113 or later to patch the broken access control. Review and revoke all workflow:execute tokens, especially those with long TTLs. Implement stricter token validation to check minter's current access during execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109362. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart