EUVD-2026-56219Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain workspace membership
-
DeliveryNavigate to WhatsApp integration settings
-
ExploitSet webhook URL to internal target (e.g., http://169.254.169.254/latest/meta-data/)
-
ExecutionWait for WhatsApp status callback to trigger forwarding
-
PersistTypebot server issues unprotected POST to internal host
-
ImpactObserve response via side-channel or error leakage
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires: (1) the attacker holds a Typebot workspace account with sufficient permissions to modify WhatsApp integration settings; (2) the affected workspace has an active WhatsApp integration configured; and (3) the public WhatsApp webhook must receive at least one status event after the malicious URL is set, which occurs organically in any active WhatsApp business workflow. Limiting factors include the PR:L authentication requirement - unauthenticated external attackers cannot exploit this directly - and the dependency on WhatsApp integration being enabled in the targeted workspace. Deployments that do not use the WhatsApp feature are not reachable via this code path. |
| Impact | The CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) correctly captures that exploitation requires a low-privilege authenticated workspace user and yields partial confidentiality and integrity impact. Real-world risk is meaningfully higher for cloud-hosted or self-hosted Typebot deployments where the server has access to cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), internal APIs, or adjacent microservices - targets that SSRF attacks routinely weaponize for credential theft or lateral movement. The scope is marked Unchanged (S:U) in the official vector, but SSRF by definition projects impact onto systems other than the vulnerable application itself, which the S:U designation may understate. No EPSS data was provided; given no KEV listing and no public POC, opportunistic mass exploitation is not currently a concern. The primary risk is insider threat or compromised workspace accounts in multi-tenant Typebot deployments with WhatsApp integration enabled. The fix is a single-line change (swap |
| Exploit ScenarioDerived | An attacker with workspace membership configures the WhatsApp status webhook forwarding URL to an internal target such as http://169.254.169.254/latest/meta-data/ (AWS IMDSv1) or http://internal-api.corp/admin. The next time the WhatsApp Cloud API delivers a status callback to the Typebot public webhook endpoint, the server automatically POSTs the payload to the attacker-controlled internal URL, and any response data may be observable through error messages or side-channel behavior. No public POC has been identified, but the technique is well-understood and requires only standard HTTP tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 11, 2026
Server-Side Request Forgery (SSRF) in Typebot's WhatsApp status webhook forwarding allows an authenticated workspace user to pivot the Typebot server into probing or interacting with internal network hosts, cloud metadata endpoints, or localhost services. The vulnerability exists in all Typebot versions prior to 3.17.0 and is triggered server-side whenever the public WhatsApp webhook receives a status payload, requiring no further interaction after the malicious URL is configured. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is straightforward for any workspace member with WhatsApp integration configuration access.
RemediationAI
Upgrade Typebot to version 3.17.0 or later, which replaces the unsafe ky.post() call with safeKy.post() in packages/whatsapp/src/forwardStatusWebhooks.ts (GitHub release tag v3.17.0, PR #2497, commit 30cbc616e00efabb193c3221b36a0d417152592c). The GitHub Security Advisory is at https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-5c92-7q58-4rgx. If immediate upgrade is not feasible, a compensating control for self-hosted deployments is to restrict outbound HTTP egress from the Typebot server at the network layer to only permitted external destinations, blocking RFC-1918 ranges, loopback, and link-local addresses - this trades some integration flexibility for protection and should be considered a temporary measure. Additionally, auditing and removing WhatsApp settings access from untrusted workspace members reduces the exploitable population until the patch is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Typebot (CPE: cpe:2.3:a:baptistearno:typebot.io:*) is an open-source chatbot builder with a WhatsApp integration that forwards status events (marketing/error callbacks from the WhatsApp Cloud API) to a workspace-configured webhook URL. The repository maintains two HTTP client instances: a standard ky client and a safeKy client that enforces SSRF protections by blocking requests to private RFC-1918 ranges, loopback addresses, link-local (169.254.x.x) metadata endpoints, and similar restricted targets. The vulnerable code path in packages/whatsapp/src/forwardStatusWebhooks.ts used the unprotected ky.post() instead of safeKy.post() when dispatching forwarded status payloads. Because the stored webhook URL is validated only as a syntactically valid URL at configuration time, an attacker-controlled URL pointing to an internal resource passes validation. CWE-918 (Server-Side Request Forgery) is the root-cause class: the server makes outbound HTTP requests to attacker-controlled destinations without adequate destination filtering.
Know when Typebot Io gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
SSRF impact falls on internal/other systems (S:C); PR:L because workspace authentication with WhatsApp settings access is required; no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings, but the forwarding code uses the raw ky instance instead of the repository's SSRF-protected safeKy client. A workspace user who can configure WhatsApp settings can therefore make the Typebot server issue HTTP requests to internal services, private-network hosts, localhost, or metadata-style endpoints whenever the public WhatsApp production webhook receives a status payload that should be forwarded. Version 3.17.0 patches the issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
More in Typebot Io
View allServer-Side Request Forgery in Typebot chatbot builder versions 3.15.2 and prior allows unauthenticated remote attackers
Cross-workspace OAuth credential takeover in Typebot (open-source chatbot builder) before 3.17.0 lets a user holding onl
Unauthenticated cross-tenant file upload in Typebot.io chatbot builder versions 3.16.1 and earlier allows anonymous visi
Cleartext storage of API bearer tokens in the self-hosted open-source Typebot chatbot builder (version 3.16.1) lets anyo
Stored cross-site scripting in Typebot chatbot builder versions 3.15.2 and prior allows a malicious imported or collabor
Stored cross-site scripting in Typebot (chatbot builder) versions 3.15.2 and prior lets an authenticated user upload a c
Unauthenticated S3 path traversal in Typebot versions prior to 3.17.0 allows any attacker to obtain presigned S3 PUT URL
Server-side request forgery in Typebot chatbot builder before version 3.17.2 allows remote unauthenticated attackers to
Server-side request forgery in Typebot before 3.17.2 lets an authenticated workspace editor or creator bypass the shared
Server-side request forgery in Typebot versions 3.15.2 and prior allows authenticated users to bypass the validateHttpRe
Credential exfiltration in Typebot prior to 3.17.0 allows a low-privilege guest workspace member to steal decrypted Open
Server-side request forgery in Typebot chatbot builder versions prior to 3.16.0 allows authenticated users to bypass SSR
Exploit-DB