CVE-2026-82291 - HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials
CVE-2026-82291 - HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials
HeyForm, prior to version 3.0.0-rc.8, reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. This vulnerability allows attackers to execute authenticated GraphQL queries from malicious pages visited by logged-in users, potentially accessing workspaces, projects, forms, submissions, and respondent data, or modifying account settings. This vulnerability is identified as CVE-2026-82291. Remotely Exploit: Yes! 🚨
The vulnerability was published on August 28, 2026, at 8:20 p.m., and was last modified at the same time. The Common Vulnerability Scoring System (CVSS) rates this vulnerability with a severity score of 8.1, classified as HIGH severity. The following products are affected by the CVE-2026-82291 vulnerability. While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-82291 is associated with the following CWEs: CWE-942: Permissive Cross-domain Policy with Untrusted Domains.
To address these issues, users should update HeyForm to version 3.0.0-rc.8 or later to mitigate CSRF vulnerabilities. It is specifically advised to implement stricter CORS policies, validate the Origin header consistently for requests, and avoid sending sensitive data with CORS requests.