CVE-2026-84207 MEDIUM

CVE-2026-84207: Heym before 0.0.98 SSRF via WebSocket endpoints

Vendor Heymrun

Product heym

Weakness CWE-918 · SSRF

Published September 1, 2026

Last update September 1, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket Trigger node.

Key dates

02Disclosure timeline

September 1, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-84207 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/918.html AskarLabs — CWE-918 write-up Server-Side Request Forgery

Related vulnerabilities

04Related CVE

CVE-2026-65496 WordPress Complianz plugin <= 7.5.0 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-11370 WP Meta SEO <= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameter CVE-2026-0688 Webmention <= 5.6.2 - Authenticated (Subscriber+) Server-Side Request Forgery CVE-2026-65467 WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-66704 WordPress Gutenverse Companion plugin <= 2.5.1 - Server Side Request Forgery (SSRF) vulnerability