CVE-2026-82291
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings.
वीकनेस
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings.
संदर्भ
- https://github.com/heyform/heyform
- https://github.com/heyform/heyform/blob/v3.0.0-rc.7/packages/server/src/main.ts
- https://github.com/heyform/heyform/commit/bf9d738ca70ae5641c0c7372982b00365c5144d4
- https://github.com/heyform/heyform/security/advisories/GHSA-fg7j-rmgr-rc9g
- https://www.vulncheck.com/advisories/heyform-reflects-any-origin-in-cors-responses-while-allowing-credentials
- https://github.com/heyform/heyform/security/advisories/GHSA-fg7j-rmgr-rc9g
हमलावर से पहले बग आप ढूँढें।
GitHub से साइन इन करें और एक मिनट से भी कम में अपना पहला ऑडिट चलाएँ। फ़्री प्लान के लिए क्रेडिट कार्ड की ज़रूरत नहीं।