CVE-2026-62862
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Typebot up to version 3.17.1 (self-hosted) has a brute-force vulnerability in the default passwordless email magic-link authentication. The code is generated using Math.random() and has only 900,000 possible combinations, with no attempt limits or lockouts, allowing account takeover. An attacker knowing the victim's email address can gain full access without victim interaction.
Risk Assessment
Risk of user account takeover, including access to bots, results, and connected integration credentials, potentially leading to data leakage and privacy breaches.
Recommendation
Update Typebot to version 3.18.0 or later. If not using email login, consider disabling this method and configuring OAuth or SSO.
Other vulnerabilities in Typebot
See all- CVE-2025-65098High
Typebot before version 3.13.2 allows client-side script execution that can steal all stored credentials from any user. When a victim previews a malicious typebot, JavaScript executes in their browser and exfiltrates OpenAI keys, Google Sheets tokens, and SMTP passwords. The /api/trpc/credentials.getCredentials endpoint returns plaintext API keys without verifying credential ownership.
- CVE-2026-48765Critical
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth `credentialsId` from a readable bot configuration and then overwrite that credential through `handleUpdateOAuthCredentials()` by supplying an attacker-controlled writable `workspaceId`. The update path validates only the attacker-supplied workspace and then updates the credential record by global `id` alone, while also rewriting the credential's `workspaceId`. This allows cross-workspace OAuth credential takeover and reassignment. Version 3.17.0 patches the issue.
- CVE-2026-47705Critical
TypeBot version 3.16.1 has a CSV injection vulnerability in the result export functionality. The application does not sanitize or escape user-supplied input when generating CSV files. An attacker can inject spreadsheet formulas into input fields, which are later executed when an administrator opens the exported CSV in spreadsheet software such as Microsoft Excel or LibreOffice Calc. Version 3.17.0 patches the issue.
- CVE-2026-47702Critical
TypeBot version 3.16.1 stores API tokens in the database as cleartext. An attacker with database read access can extract all tokens and impersonate any user without password or MFA.
- CVE-2026-48768Critical
TypeBot is a chatbot builder tool that in versions 3.16.1 and earlier has an unauthenticated endpoint for generating upload URLs. This allows anonymous users to upload malicious HTML, SVG, or JS files, potentially leading to stored XSS.
- CVE-2026-10731Critical
SQL injection in the 'two_steps_auth_code' parameter processed by the 'twoStepsAuthVerification' function in the '/user-login' endpoint. The 2FA functionality is accessible without authentication, allowing unauthenticated attackers to execute arbitrary SQL queries. Successful exploit can lead to database enumeration, unauthorized creation of privileged users, modification or deletion of critical information, and denial of service.
- CVE-2026-33712Critical
Typebot versions 3.15.2 and prior have an SSRF vulnerability in the preview chat endpoint. An unauthenticated attacker can supply a custom typebot definition with server-side code, bypassing SSRF validation and making network requests from the server.
- CVE-2025-64709Critical
Typebot, an open-source chatbot builder, in versions prior to 3.13.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the webhook block (HTTP Request component). Authenticated users can make arbitrary HTTP requests from the server, including access to AWS Instance Metadata Service (IMDS). By bypassing IMDSv2 protection through custom header injection, attackers can extract temporary AWS IAM credentials for the EKS node role, leading to complete compromise of the Kubernetes cluster and associated AWS infrastructure. Version 3.13.1 fixes the issue.
- CVE-2026-62865High
Typebot in self-hosted versions prior to 3.18.0 has a vulnerability in the Send Email integration block that allows arbitrary reading of local files on the server. The block builds Nodemailer attachments from typebot variables, and its parseAttachments helper returns the supplied value as a filesystem path whenever it does not start with the application's own base URL. The Nodemailer transport is created without disabling file access, so an attachment specified as an absolute server path is read from the local filesystem and delivered.
- CVE-2026-62861Medium
TypeBot prior to 3.18.0 has a vulnerability that allows any authenticated non-guest workspace member to remove another workspace's public custom domain and make typebots on that domain unavailable. The custom-domain delete handler authorizes a caller against a client-supplied workspaceId but sends the client-supplied domain name to the shared Vercel project before verifying that the domain belongs to that workspace.
Original NVD description (English source)
Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vulnerable to login-code brute forcing that leads to account takeover. The email provider overrides NextAuth's default cryptographically secure token with a 6-digit code generated using Math.random(), reducing the keyspace to 900,000 with a 10-minute expiry, and the code itself is the raw value placed in the magic link. The verification callback enforces no attempt limit, lockout, or CSRF protection, and an incorrect guess does not consume the real code because the adapter returns null on a not-found token, so a valid code survives unlimited guessing within its lifetime. The only rate limiter applies to the code-sending path and is keyed on the client-controlled X-Forwarded-For header, allowing an attacker to request many concurrent live codes for one victim and further raise the odds of a matching guess. As a result, an anonymous attacker who knows a victim's email address can brute-force the callback and obtain an authenticated session as that user with no victim interaction, gaining full access to the victim's bots, results, and connected integration credentials. Deployments configured for OAuth or SSO only, with no email provider, are not affected. This issue is fixed in version 3.18.0
Vulnerability data from NVD (NIST) · CISA KEV · EPSS