Description

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-28T20:20:20.820Z",
  "pubdate": "2026-08-28T20:20:20.820Z",
  "executiveSummary": "HeyForm versions prior to 3.0.0-rc.8 are affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability. The application dynamically reflects the 'Origin' request header in its CORS response headers while simultaneously permitting the inclusion of user credentials (e.g., cookies or authorization headers).\nThis configuration effectively bypasses the Same-Origin Policy (SOP) protections intended to prevent unauthorized cross-site requests. By leveraging this misconfiguration, a malicious actor can craft a web page that executes authenticated GraphQL queries on behalf of an unsuspecting, logged-in HeyForm user. The impact is significant, as it grants attackers the ability to exfiltrate sensitive data, including workspaces, projects, form definitions, submission data, and respondent information. Furthermore, attackers may perform unauthorized actions, such as modifying account settings or performing administrative modifications within the context of the victim's session.\nThe vulnerability requires the victim to be authenticated to the HeyForm instance and to visit an attacker-controlled origin. No user interaction beyond navigating to a malicious site is strictly necessary to trigger the exploit, as the browser automatically attaches credentials to the requests under the permissive CORS policy.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure implementation of the CORS security protocol within the HeyForm backend. Specifically, the server-side logic processes the 'Origin' header provided by incoming HTTP requests and reflects it back to the browser in the 'Access-Control-Allow-Origin' header without proper validation or allowlisting.\nConcurrent with the reflected 'Access-Control-Allow-Origin' header, the server explicitly sets 'Access-Control-Allow-Credentials' to 'true'. Under the CORS specification, the combination of a reflected origin and the inclusion of credentials creates an insecure environment where browsers permit cross-site requests to bypass SOP. This allows third-party domains to read the response of requests that are authenticated via cookies or other browser-based credentials.\nThe attack flow proceeds as follows: 1) An attacker identifies a logged-in victim and lures them to a malicious web domain. 2) The malicious page executes a script that initiates a cross-origin XMLHttpRequest or Fetch API request to the target HeyForm instance. 3) Because the attacker-controlled origin is reflected in the 'Access-Control-Allow-Origin' header and the 'Access-Control-Allow-Credentials' header is enabled, the victim's browser automatically attaches their session cookies to the request. 4) The HeyForm server processes the request as if it were a legitimate, authenticated session, as the identity of the user is confirmed through the attached session cookies. 5) The server executes the GraphQL query or mutation and returns the sensitive data back to the attacker's script.\nBecause HeyForm utilizes GraphQL for its backend communication, the attacker can leverage this vulnerability to interact with the full suite of GraphQL queries and mutations available to the logged-in user. This encompasses the retrieval of sensitive project and form configurations, submission data, and respondent personal information. Additionally, the ability to execute mutations allows the attacker to potentially alter account configurations, update API keys, or change user profile information. The vulnerability affects all versions of HeyForm prior to 3.0.0-rc.8. The attack is restricted to browsers that respect CORS policies and requires the victim to have an active session with the vulnerable HeyForm instance, but it is highly effective at bypassing network-level security controls because the requests originate from the victim’s own browser."
}