Typebot CVE-2026-39969

Exploitation requires that the target Typebot deployment has configured at least one WhatsApp Cloud API integration, which creates the vulnerable endpoint at POST /v1/workspaces/{workspaceId}/whatsapp/{credentialsId}/webhook. The attacker must obtain the workspaceId and credentialsId path parameters; these are semi-public by design - they appear in Meta's developer webhook configuration dashboard during integration setup, in web server access logs, and in any shared integration documentation. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication, no elevated privileges, and no user interaction are required once the URL is known. Exploitation is limited to Typebot instances running version 3.16.0 or earlier with an active WhatsApp integration configured; instances without WhatsApp configured are not exposed, and cloud-hosted typebot.io users were patched upon the vendor's deployment of v3.17.0.

The CVSS 6.5 score (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) reflects a medium-severity finding, but the practical exploitability is meaningfully higher than the raw score implies. The PR:N and AC:L combination confirms the attack requires no authentication and no special conditions beyond knowing the webhook URL - and the URL is semi-public by design. EPSS data was not provided in the available intelligence and cannot be inferred. This CVE is not listed in CISA KEV and no public exploit code has been identified at time of analysis, indicating no confirmed widespread exploitation. However, the absent verification is a single missing check, the path parameters are routinely accessible, and successful exploitation can abuse downstream external service credentials held by the workspace owner. Organizations running self-hosted Typebot instances with active WhatsApp integrations should treat this as an elevated operational priority despite the moderate CVSS score, as the CVSS impact metrics underrepresent the downstream credential-abuse potential.

An attacker obtains the webhook URL by reviewing Meta's developer webhook configuration dashboard (where the URL is displayed during integration setup) or by accessing exposed web server access logs. The attacker then sends an unauthenticated HTTP POST request to POST /v1/workspaces/{workspaceId}/whatsapp/{credentialsId}/webhook with a crafted payload mimicking a legitimate Meta WhatsApp event, which the server accepts without verifying the absent x-hub-signature-256 HMAC header. The spoofed event triggers configured bot automation flows, potentially sending messages, calling external APIs, or interacting with third-party services using credentials stored in the workspace.