CVE-2026-101050 — Heym before 0.0.53 Authentication Bypass via Telegram Webhook

Back Back to CVE browser

HIGH

Heym before 0.0.53 Authentication Bypass via Telegram Webhook

Published Sep 27, 2026

8.3

HIGH

CVSS 4.0

EPSS 0.30%

Description

Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execute actions on attacker-supplied input.

Affected products

Vendor Heymrun Product Heym Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <0.0.53
- Version
  0.0.53
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Heymrun

Heym

unaffected

Version	Status	Constraints
0	affected	<0.0.53
0.0.53	unaffected	-

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-287

Improper Authentication

References (3)

https://github.com/heymrun/heym/commit/341d1012367cd74f85c617e1c98dd49e3fcb5e83
patch
https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h
exploitvendor-advisory
https://www.vulncheck.com/advisories/heym-before-0.0.53-authentication-bypass-via-telegram-webhook
third-party-advisory

Link	Providers	Tags
https://github.com/heymrun/heym/commit/341d1012367cd74f85c617e1c98dd49e3fcb5e83		patch
https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h		exploitvendor-advisory
https://www.vulncheck.com/advisories/heym-before-0.0.53-authentication-bypass-via-telegram-webhook		third-party-advisory