Description (CNA)
Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner cannot list or revoke, and repeatedly run the workflow consuming shared credentials.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| heymrun / heym | affected 0.0.5 before 0.0.113; unaffected 0.0.113 |
CWE
CWE-613
References
- https://github.com/heymrun/heym/security/advisories/GHSA-pwr6-6377-3cgv
- https://www.vulncheck.com/advisories/heym-0.0.5-before-0.0.113-broken-access-control-via-workflow-execution-tokens
ADP enrichment
No English description supplied.