EUVD-2026-56243Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Network callback endpoint requires authenticated session (PR:L); attacker can inject credentials cross-workspace (I:H) with potential minor information exposure (C:L); no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON state parameter and trusts the embedded workspaceId, typebotId, blockId, and redirectUrl without cryptographic integrity protection or authorization checks. The callback route is authenticated, but it does not verify that the authenticated user has write access to the target workspace or Typebot before creating credentials in the workspace or updating Typebot groups. An authenticated user who can obtain a valid Google OAuth code can alter the state value to create Google Sheets credentials in another workspace and, if target IDs are known, attach those credentials to a block in another Typebot. Version 3.17.0 patches the issue.
AnalysisAI
Cross-workspace credential injection in Typebot's Google Sheets OAuth callback allows an authenticated attacker to plant Google Sheets credentials into workspaces they do not own, and - if target IDs are known - attach those credentials to blocks inside victim Typebots. The root cause is that the OAuth callback decodes and blindly trusts a client-supplied, unprotected base64 JSON state parameter without verifying the authenticated user holds write access to the referenced workspaceId or typebotId. All Typebot versions prior to 3.17.0 are affected; no public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
Typebot is an open-source chatbot builder (cpe:2.3:a:baptistearno:typebot.io) that integrates with Google Sheets via OAuth 2.0. During the authorization-code flow, the OAuth provider returns a state parameter that Typebot encodes as base64 JSON containing workspaceId, typebotId, blockId, and redirectUrl. Prior to 3.17.0, the callback handler decoded this client-supplied value and used its contents directly to create or update database records without any HMAC or signature verification and - critically - without calling authorization helpers to confirm the session user had write access to the identified workspace or Typebot (CWE-862: Missing Authorization). The PR #2501 fix introduces getAuthorizedGoogleSheetsOAuthResources, which queries the database for workspace membership and calls isWriteWorkspaceForbidden and isWriteTypebotForbidden before proceeding, and adds cryptographically signed, nonce-backed state with an HttpOnly SameSite=Lax cookie to prevent tampering.
RemediationAI
The primary fix is to upgrade to Typebot version 3.17.0, available at https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0. This release introduces cryptographic signing of the OAuth state parameter (with nonce and HttpOnly cookie binding) and adds explicit write-authorization checks against workspace membership and Typebot collaborators before processing the callback. For self-hosted operators who cannot immediately upgrade, a partial compensating control is to restrict network access to the OAuth callback endpoint (/api/...) to authenticated internal users only using a reverse-proxy ACL, though this does not eliminate the authorization bypass for users with existing valid sessions. Disabling the Google Sheets integration entirely in the self-hosted configuration eliminates the attack surface completely if the feature is not needed. There are no known workarounds that fully replicate the patch's protection without upgrading.
More in Typebot Io
View allServer-Side Request Forgery in Typebot chatbot builder versions 3.15.2 and prior allows unauthenticated remote attackers
Cross-workspace OAuth credential takeover in Typebot (open-source chatbot builder) before 3.17.0 lets a user holding onl
Unauthenticated cross-tenant file upload in Typebot.io chatbot builder versions 3.16.1 and earlier allows anonymous visi
Cleartext storage of API bearer tokens in the self-hosted open-source Typebot chatbot builder (version 3.16.1) lets anyo
Stored cross-site scripting in Typebot chatbot builder versions 3.15.2 and prior allows a malicious imported or collabor
Stored cross-site scripting in Typebot (chatbot builder) versions 3.15.2 and prior lets an authenticated user upload a c
Unauthenticated S3 path traversal in Typebot versions prior to 3.17.0 allows any attacker to obtain presigned S3 PUT URL
Server-side request forgery in Typebot chatbot builder before version 3.17.2 allows remote unauthenticated attackers to
Server-side request forgery in Typebot before 3.17.2 lets an authenticated workspace editor or creator bypass the shared
Server-side request forgery in Typebot versions 3.15.2 and prior allows authenticated users to bypass the validateHttpRe
Credential exfiltration in Typebot prior to 3.17.0 allows a low-privilege guest workspace member to steal decrypted Open
Server-side request forgery in Typebot chatbot builder versions prior to 3.16.0 allows authenticated users to bypass SSR
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today