Cleartext storage of API tokens in TypeBot (CVE-2026-47702)

TypeBot version 3.16.1 stores API bearer tokens as plaintext strings in the database with no hashing or encryption applied. An attacker who gains read access to the database-through SQL injection, backup exposure, or insider access-can extract all tokens and impersonate any user without needing a password or multi-factor authentication. Exploitation results in full account takeover and workspace compromise. Affected versions: - 3.16.1 We recommend updating to: 3.17.0. CVSS 9.1 · our assessment: act_now Reference: https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-9c96-gcg3-2662 Details: https://vuln.today/cve/CVE-2026-47702