CyberRota Analysis
AI-GeneratedHeyForm versions prior to 3.0.0-rc.8 are vulnerable due to improper handling of the Origin header in CORS responses, which allows cross-origin requests with credentials. This flaw enables attackers to execute authenticated GraphQL queries from malicious sites, potentially compromising sensitive user data and account settings. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized access and data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings.