Typebot
CVE-2025-64706
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Typebot instance
-
ExploitEnumerate target user ID and token ID
-
ExecutionCall token endpoint lacking authorization check
-
ImpactRetrieve and delete victim's API token
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must hold a valid authenticated account on the Typebot instance (CVSS PR:L) running an affected version (3.9.0 through 3.12.x) and must know or enumerate the target victim's user ID and API token ID to reach the vulnerable API token management endpoint, which performs no authorization check. No user interaction is required (UI:N) and no special non-default configuration is named. Limiting factors: requires a pre-existing account (so relevant mainly to multi-user/multi-tenant or publicly-registerable instances) and knowledge of two target identifiers; upgrading to 3.13.0 removes the flaw. |
| Impact | Signals point to a real but moderate, not urgent, priority. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.5 High) describes a network-reachable flaw requiring an authenticated low-privilege account. A public exploit reference exists (via the GitHub Security Advisory), but there is NO CISA KEV listing and EPSS is very low at 0.08% (23rd percentile), indicating no evidence of widespread automated exploitation. The CVSS vector's AC:H (high attack complexity) is questionable for a classic IDOR: the description says exploitation is achieved 'by simply knowing the target user's ID and token ID,' which for an enumerable object-reference flaw usually implies LOW complexity - this inconsistency should be verified against the vendor advisory and suggests real-world difficulty may be lower than the 7.5 score's AC:H implies. Net read: a genuine broken-access-control bug in self-hosted/cloud Typebot that an existing authenticated user can abuse, but low exploitation probability and no active-exploitation evidence place it below internet-facing unauthenticated RCEs in priority. POC availability is a distinct signal from active exploitation and should not be read as the latter. |
| Exploit ScenarioDerived | An authenticated low-privilege Typebot user (any registered account on a shared/multi-tenant or self-hosted instance running 3.9.0-3.12.x) identifies another user's ID and token ID and calls the API token management endpoint, which performs no authorization check. They retrieve the victim's API token value - enabling impersonation and API access as that user - and can also delete the victim's token. Publicly available exploit code is referenced in the GitHub Security Advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 18, 2026
Typebot 3.9.0 through 3.12.x contains an insecure direct object reference in its API token management endpoint that allows any authenticated user to delete another user's API token and retrieve its value by supplying the victim's user ID and token ID. The endpoint performs no authorization check, so the flaw is most relevant to multiuser, multi-tenant, or publicly registerable Typebot instances where an attacker can obtain a valid account. Publicly available exploit code exists, but there is no KEV-based confirmation of active exploitation; EPSS is low at 0.08% (23rd percentile).
Earlier versions of this analysis (1)
Typebot is an open-source chatbot builder. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
RemediationAI
Upgrade Typebot to 3.13.0, the vendor-released fix, per GHSA-grx8-g27p-8hpp (https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-grx8-g27p-8hpp). If immediate upgrade is not possible, disable or tightly restrict public self-registration and limit the instance to trusted users to reduce exposure to the PR:L prerequisite; the trade-off is loss of self-service onboarding. Restrict network access to API token management functions to trusted IP ranges or a VPN/admin network; the trade-off is reduced remote usability and possible breakage for distributed teams. Audit API token creation, retrieval, and deletion logs for unexpected access, and rotate or revoke exposed API tokens, especially where a victim's user ID and token ID may have been shared; the trade-off is that rotation invalidates existing integrations until updated. These controls reduce exposure but do not replace the object-level authorization fix in 3.13.0.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Typebot is an open-source chatbot builder, and the affected component is its API token management endpoint. The root cause is CWE-284 (Improper Access Control): the endpoint accepts a user ID and token ID from the request but fails to verify that the authenticated caller owns the target token, creating an IDOR. With a valid account (PR:L) and knowledge of two identifiers, an attacker can perform token disclosure and deletion over the network without user interaction. The CPE cpe:2.3:a:typebot:typebot:*:*:*:*:*:-:*:* is a broad wildcard for the Typebot package, so version scoping should follow the vendor advisory covering 3.9.0 to <3.13.0. The independent assessment uses CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; the original CVE vector listed AC:H, but the operative assessment treats complexity as low once the required account and identifiers are available.
Know when Typebot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network endpoint reachable by any authenticated user (AV:N/PR:L); object references are enumerable so AC:L (contra vendor's AC:H); token disclosure plus deletion yield C:H and I:H/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Typebot is an open-source chatbot builder. In version 3.9.0 up to but excluding version 3.13.0, an Insecure Direct Object Reference (IDOR) vulnerability exists in the API token management endpoint. An authenticated attacker can delete any user's API token and retrieve its value by simply knowing the target user's ID and token ID, without requiring authorization checks. Version 3.13.0 fixes the issue.
Executive ViewAI
Typebot versions 3.9.0 through 3.12.x contain an API token management flaw that lets a user with a valid account retrieve and delete other users' tokens, creating cross-account and cross-tenant risk for organizations running public or multi-user Typebot deployments. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation. Leadership should prioritize containment and tenant isolation because stolen tokens can expose integrations, customer data, and downstream workflows until a vendor fix is available.
No vendor-released patch identified at time of analysis; interim controls include disabling public registration, restricting Typebot access to trusted users and networks, rotating API tokens, enforcing least-privilege token scopes, monitoring token management logs, and isolating multi-tenant instances until a fixed release is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)NVD
Authenticated Typebot users can abuse the webhook block (HTTP Request component) in versions prior to 3.13.1 to issue ar
Typebot is an open-source chatbot builder. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitabl
Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows s
The Typebot | Build beautiful conversational forms WordPress plugin before 1.4.3 does not sanitise and escape the Publis
Exploit-DB