CVE-2026-82291

HeyForm before 3.0.0-rc.8 reflects whatever Origin header a request supplies in its CORS responses while still allowing credentials, so any website is treated as a trusted cross-origin source. An attacker hosts a malicious page, and when a logged-in HeyForm user visits it, the page can issue authenticated GraphQL queries cross-origin with the user's credentials. This lets the attacker read workspaces, projects, forms, submissions, and respondent data, or change the victim's account settings. Any self-hosted HeyForm deployment running an affected version is exposed whenever its logged-in users can be lured to attacker-controlled pages. There is currently no public proof-of-concept, the EPSS score is low (0.3% probability of exploitation in 30 days), and the flaw is not in CISA KEV, so no exploitation is known.

What to do: Upgrade HeyForm to 3.0.0-rc.8 or later. As an interim mitigation, restrict the CORS configuration to a fixed allowlist of known origins instead of reflecting arbitrary Origin headers with credentials enabled. Review recent account-setting changes and GraphQL access to workspaces, forms, and submissions for signs of unauthorized access.