EUVD-2026-56220Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable IDOR requiring low-privilege auth to trigger; high integrity impact via cross-tenant session injection; no confidentiality or availability impact identified.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
TypeBot is a chatbot builder tool. Prior to version 3.17.0, an authenticated user who has read access to any typebot can resume a waiting webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign live resultId. The webhook resume handler authorizes the parent typebot first, but then resolves the descendant result only by resultId. As a result, an attacker can inject arbitrary webhook JSON into another typebot's suspended session and advance its execution without any access to the victim typebot. Version 3.17.0 patches the issue.
AnalysisAI
Typebot's webhook resume endpoint exposes an insecure direct object reference flaw that allows any authenticated user holding read access to at least one typebot to inject arbitrary JSON payloads into a suspended webhook session owned by a completely different typebot on the same instance. The handler validates authorization against the caller-supplied typebotId but then resolves the session result record solely by resultId without binding it to the authorized typebot, enabling an attacker to mix a legitimately authorized typebotId and blockId with a foreign live resultId to hijack cross-tenant execution flow and advance the victim's business logic. No public exploit has been identified at time of analysis; vendor-released patch version 3.17.0 is available and resolves the flaw.
Technical ContextAI
TypeBot (cpe:2.3:a:baptistearno:typebot.io:*:*:*:*:*:*:*:*) is an open-source, self-hostable chatbot builder built on a Next.js/Node.js stack that persists session state in a relational database via the Prisma ORM. The vulnerable code path resides in packages/blocks/webhook/src/api/handleExecuteWebhook.ts, which processes asynchronous webhook callbacks that resume paused typebot execution flows. The root cause maps directly to CWE-639 (Authorization Bypass Through User-Controlled Key): the handler correctly verifies that the caller has access to the typebotId supplied in the request, but then issues a Prisma findUnique query keyed solely on the caller-controlled resultId without cross-referencing that the located result record's typebotId matches the authorized one. The fix in v3.17.0 (PR #2494, commit 6f915c3) changes the query to findFirst with an additional typebotId constraint, ensuring result records can only be resolved within the security boundary of the authorized typebot.
RemediationAI
The primary fix is to upgrade Typebot to version 3.17.0 or later, confirmed available at https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0 and resolving the flaw by adding a typebotId constraint to the Prisma result lookup in the webhook resume handler (PR #2494: https://github.com/baptisteArno/typebot.io/pull/2494, commit 6f915c3). For operators who cannot upgrade immediately, a compensating control is to restrict access to the webhook resume endpoint at the reverse-proxy or network layer to a known set of trusted IP ranges, accepting the trade-off of breaking legitimate external webhook callbacks originating from untrusted origins. Disabling the webhook block feature entirely for typebots that do not require it eliminates the attack surface but requires reconfiguring affected chatbot flows. No workaround is known that preserves full webhook functionality without applying the upstream patch.
More in Typebot Io
View allServer-Side Request Forgery in Typebot chatbot builder versions 3.15.2 and prior allows unauthenticated remote attackers
Cross-workspace OAuth credential takeover in Typebot (open-source chatbot builder) before 3.17.0 lets a user holding onl
Unauthenticated cross-tenant file upload in Typebot.io chatbot builder versions 3.16.1 and earlier allows anonymous visi
Cleartext storage of API bearer tokens in the self-hosted open-source Typebot chatbot builder (version 3.16.1) lets anyo
Stored cross-site scripting in Typebot chatbot builder versions 3.15.2 and prior allows a malicious imported or collabor
Stored cross-site scripting in Typebot (chatbot builder) versions 3.15.2 and prior lets an authenticated user upload a c
Unauthenticated S3 path traversal in Typebot versions prior to 3.17.0 allows any attacker to obtain presigned S3 PUT URL
Server-side request forgery in Typebot chatbot builder before version 3.17.2 allows remote unauthenticated attackers to
Server-side request forgery in Typebot before 3.17.2 lets an authenticated workspace editor or creator bypass the shared
Server-side request forgery in Typebot versions 3.15.2 and prior allows authenticated users to bypass the validateHttpRe
Credential exfiltration in Typebot prior to 3.17.0 allows a low-privilege guest workspace member to steal decrypted Open
Server-side request forgery in Typebot chatbot builder versions prior to 3.16.0 allows authenticated users to bypass SSR
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today