CVE-2026-48495
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
TypeBot before version 3.17.0 in the Google Sheets OAuth callback decodes a base64-encoded JSON `state` parameter and trusts the embedded values without cryptographic integrity protection or authorization checks. An authenticated user who can obtain a valid Google OAuth `code` can alter the `state` to create credentials in another workspace and attach them to a block in another Typebot. Version 3.17.0 patches the issue.
Risk Assessment
The risk includes unauthorized creation of credentials in other workspaces and potential takeover of blocks in other Typebots, leading to data integrity issues and unauthorized access.
Recommendation
Upgrade TypeBot to version 3.17.0 or later. Also implement integrity verification for `state` parameters and access control for write operations.
Original NVD description (English source)
TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON `state` parameter and trusts the embedded `workspaceId`, `typebotId`, `blockId`, and `redirectUrl` without cryptographic integrity protection or authorization checks. The callback route is authenticated, but it does not verify that the authenticated user has write access to the target workspace or Typebot before creating credentials in the workspace or updating Typebot groups. An authenticated user who can obtain a valid Google OAuth `code` can alter the `state` value to create Google Sheets credentials in another workspace and, if target IDs are known, attach those credentials to a block in another Typebot. Version 3.17.0 patches the issue.