Spoofable Origin Header Leak Capability Token in HITL Review Service

Vulnerability Overview Title: HITL review links built from spoofable Origin/X-Forwarded-Host headers leak the capability token to attacker-controlled domains Description: The function in derives the public base URL for HITL review links from client-controlled request headers (such as or ). If the header is present, it is used preferentially; otherwise, if the header is present, it is used; finally, it falls back to server-side configuration ( or ). The generated URL contains the capability token, which allows full access to the review request, and is sent to external reviewers via notification branches (such as email, Slack, Discord, Telegram). Attack Scenario: 1. The victim publishes a workflow with an anonymous authentication trigger. 2. The attacker discovers the workflow execution endpoint and POSTs a trigger with a forged header in the shared webhook URL. 3. The runtime pauses at the HITL node, calling , which returns and stores in the reviewer's . 4. The notification branch sends the payload to legitimate channels; the link structure is identical to the real link, but the domain differs. 5. The reviewer clicks the link, and the attacker records the token, allowing them to proxy a fake review page or silently use the token. 6. The decision resumes the workflow, using the or from the execution snapshot. These are the credentials and global variables of the reviewer, not the attacker. Security Impact: Unauthenticated attackers can make arbitrary decisions at human review checkpoints, approving or rejecting reviewers, or injecting arbitrary text into the workflow. Credential adjacency: Downstream nodes can send data or call third-party services using stored credentials, controlled by the attacker's decisions. Same-class impact: File sharing/download links are constructed from the same assistant (the token-carrying URL redirects to the attacker's domain). Scope Affected Versions: Affected versions: <= v0.0.110 Fixed version: v0.0.12 Affected Components/Commits: — (lines 23-34, commit 5e7039a19a9d4e18a5899ed0a2a7a36307e, v0.0.110) Reachable from every execution entry point, passing request-scope values to , specifically: - — (webhook/API triggers, allowing anonymous authentication via ) - , , The same header trust helper constructs other shared/download links ( , , , , mint payment URLs, etc.), meaning these links inherit the same issue. Remediation Recommended Fix: Build capability-carrying URLs solely from server-side configuration ( , falling back to the CORS allowlist). This is equivalent to using , which is already implemented for background execution paths in and . Alternatively, validate the / values against the configured CORS allowlist; otherwise, reject the request. Audit sibling sites ( , , , etc.) that mint token-carrying URLs in the same manner. Heyym Team Notes: The MCP file upload mint URL behavior has been changed to follow instead of the client's . Consequently, any deployment without set will return localhost links. The two findings remain open and are tracked separately because the token is returned to the triggering caller and is stored in plaintext. Thank you again. POC Code Summary This vulnerability allows unauthenticated attackers to leak capability tokens to attacker-controlled domains by forging or headers, thereby gaining full access to review requests and enabling arbitrary decision-making. The remediation includes building capability-carrying URLs exclusively from server-side configuration, validating / values, and auditing sibling sites.

Goal Reached Thanks to every supporter — we hit 100%!

Spoofable Origin Header Leak Capability Token in HITL Review Service

More from this source