Which versions of Typebot are affected by CVE-2026-47702?

Typebot self-hosted chatbot builders running version 3.16.1 or earlier are vulnerable to credential theft enabling complete account takeover across all user tenants.

How to fix or mitigate CVE-2026-47702?

Within 24 hours, identify all Typebot instances running version 3.16.1 or earlier, immediately restrict database access to authorized administrators only to prevent credential theft, enable comprehensive audit logging of all database access, and review logs for unauthorized activity. Within 7 days, upgrade all affected instances to Typebot version 3.17.0 or later, which implements SHA-256 hashing for token storage. Within 30 days, audit all API tokens generated prior to the upgrade, revoke credentials from accounts exhibiting suspicious activity, implement token rotation policies for high-privilege accounts, and conduct a full review of database access logs spanning 90 days to identify any potential compromise.

Typebot CVE-2026-47702

Q: What is the CVSS score of CVE-2026-47702?

CVE-2026-47702 has a CVSS 4.0 base score of 9.1 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-56152 CRITICAL

Cleartext Storage of Sensitive Information (CWE-312)

2026-08-11 GitHub_M

SQLi Typebot Io Baptistearno

9.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.1 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.4 HIGH

AC:H because exploitation depends on first obtaining database read access via a separate vector; C:H/I:H as stolen tokens enable full user impersonation, A:N as availability is unaffected.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 11, 2026 - 15:06 vuln.today

Analysis Generated

Aug 11, 2026 - 15:06 vuln.today

CVE Published

Aug 11, 2026 - 14:03 cve.org

CRITICAL 9.1

DescriptionCVE.org

TypeBot is a chatbot builder tool. In version 3.16.1, API tokens (bearer credentials used to authenticate against the builder API) are stored in the database as cleartext strings. An attacker who gains read access to the database (e.g., via SQL injection, backup exposure, or insider access) can extract all API tokens and impersonate any user without requiring a password or multi-factor authentication. Version 3.17.0 fixes the issue.

AnalysisAI

Cleartext storage of API bearer tokens in the self-hosted open-source Typebot chatbot builder (version 3.16.1) lets anyone with read access to the backing database recover every user's builder-API credential verbatim and impersonate that user with no password or MFA. The tokens were persisted with the plaintext value returned by generateId(24) rather than a hash, so a single database disclosure - via SQL injection, an exposed backup, or insider access - yields full account takeover across all tenants. Version 3.17.0 remediates the flaw by SHA-256 hashing tokens at rest; there is no public exploit identified at time of analysis and it is not in CISA KEV.

Technical ContextAI

Typebot is a Node.js/TypeScript chatbot builder (apps/builder and apps/viewer) that uses Prisma against a relational database (the SQLi tag and description point to a Postgres-style backend). API tokens are long-lived bearer credentials authenticating against the builder API. Root cause is CWE-312 (Cleartext Storage of Sensitive Information): handleCreateApiToken.ts stored the raw token string (data: { token: generateId(24) }) and authenticateUser/authenticateWithBearerToken compared the presented bearer value directly against that stored plaintext. Because the stored form equals the usable secret, database read = credential theft. The fix introduces packages/lib/src/apiToken.ts, which generates tokens with randomBytes(32).toString('base64url') and stores only createHash('sha256').update(token).digest('hex'); authentication now hashes the incoming token before lookup, with a transparent one-time migration that re-hashes any legacy plaintext token on first use and an isHashedApiToken guard so already-hashed values cannot be re-authenticated as plaintext.

RemediationAI

Vendor-released patch: 3.17.0 - upgrade self-hosted Typebot to v3.17.0 or later (https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0), which hashes tokens at rest and auto-migrates existing plaintext tokens to SHA-256 on their next authenticated use. Because pre-upgrade tokens sit in the database as plaintext and any prior database exposure may have already leaked them, revoke and reissue all existing API tokens after upgrading rather than relying solely on the transparent migration. If you cannot upgrade immediately, reduce the enabling exposure: restrict database network access to the application only, encrypt and tightly access-control database backups, audit for SQL injection exposure in the builder/viewer APIs, and rotate API tokens periodically - accepting that these controls limit but do not eliminate the underlying plaintext-at-rest weakness. Reference: advisory GHSA-9c96-gcg3-2662 and PR #2492.