Cross-Origin Resource Sharing Vulnerability in HeyForm by HeyForm

CVE-2026-82291

What is CVE-2026-82291?

The HeyForm product prior to version 3.0.0-rc.8 has a vulnerability that reflects the request Origin header in CORS responses while permitting credentials. This flaw enables attackers to perform cross-origin requests that include authentication. Consequently, malicious web pages can execute authenticated GraphQL queries, which can lead to unauthorized access to sensitive data such as workspaces, projects, forms, submissions, and respondent information. Additionally, attackers have the potential to modify account settings, making this a serious security concern.

References