EUVD-2026-56974Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Network ORPC endpoint (AV:N/AC:L) needs a low-privilege authenticated read collaborator (PR:L); impact crosses the workspace boundary (S:C) with credential disclosure (C:H), overwrite/reassignment (I:H), and loss of the victim's credential (A:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth credentialsId from a readable bot configuration and then overwrite that credential through handleUpdateOAuthCredentials() by supplying an attacker-controlled writable workspaceId. The update path validates only the attacker-supplied workspace and then updates the credential record by global id alone, while also rewriting the credential's workspaceId. This allows cross-workspace OAuth credential takeover and reassignment. Version 3.17.0 patches the issue.
AnalysisAI
Cross-workspace OAuth credential takeover in Typebot (open-source chatbot builder) before 3.17.0 lets a user holding only read-collaborator access on a bot read a workspace's OAuth credentialsId and then overwrite that credential by calling handleUpdateOAuthCredentials() with an attacker-controlled writable workspaceId. Because the update authorized only the attacker's supplied workspace but then located and mutated the credential by its global id alone (and rewrote its workspaceId), a low-privilege user in one workspace can seize and reassign OAuth credentials belonging to another workspace. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Typebot account (CVSS PR:L) that (1) holds at least read-collaborator access to a bot in the victim workspace so the OAuth `credentialsId` can be read from the bot configuration, and (2) has write access to a second workspace whose `workspaceId` the attacker supplies to pass the flawed authorization check in handleUpdateOAuthCredentials(). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L is internally consistent with the description: a network-reachable ORPC endpoint, low complexity, and only a low-privilege authenticated account (read collaborator) required, with a scope change reflecting that impact crosses the workspace security boundary. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Typebot 3.17.0, which adds an existence/ownership check (prisma.credentials.findUnique scoped by both `id` and `workspaceId`, returning NOT_FOUND when the credential does not belong to the supplied workspace) and switches the Google Sheets and OpenAI integration handlers from a read-permission to a write-permission check (isWriteWorkspaceForbidden). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Typebot deployments, confirm versions in use, and assess which workspaces contain OAuth-integrated chatbots. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Typebot Io
View allServer-Side Request Forgery in Typebot chatbot builder versions 3.15.2 and prior allows unauthenticated remote attackers
Unauthenticated cross-tenant file upload in Typebot.io chatbot builder versions 3.16.1 and earlier allows anonymous visi
Cleartext storage of API bearer tokens in the self-hosted open-source Typebot chatbot builder (version 3.16.1) lets anyo
Stored cross-site scripting in Typebot chatbot builder versions 3.15.2 and prior allows a malicious imported or collabor
Stored cross-site scripting in Typebot (chatbot builder) versions 3.15.2 and prior lets an authenticated user upload a c
Server-side request forgery in Typebot chatbot builder before version 3.17.2 allows remote unauthenticated attackers to
Unauthenticated S3 path traversal in Typebot versions prior to 3.17.0 allows any attacker to obtain presigned S3 PUT URL
Server-side request forgery in Typebot before 3.17.2 lets an authenticated workspace editor or creator bypass the shared
Server-side request forgery in Typebot versions 3.15.2 and prior allows authenticated users to bypass the validateHttpRe
Credential exfiltration in Typebot prior to 3.17.0 allows a low-privilege guest workspace member to steal decrypted Open
Server-side request forgery in Typebot chatbot builder versions prior to 3.16.0 allows authenticated users to bypass SSR
Typebot's webhook resume endpoint exposes an insecure direct object reference flaw that allows any authenticated user ho
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today