EUVD-2026-56974Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Network ORPC endpoint (AV:N/AC:L) needs a low-privilege authenticated read collaborator (PR:L); impact crosses the workspace boundary (S:C) with credential disclosure (C:H), overwrite/reassignment (I:H), and loss of the victim's credential (A:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth credentialsId from a readable bot configuration and then overwrite that credential through handleUpdateOAuthCredentials() by supplying an attacker-controlled writable workspaceId. The update path validates only the attacker-supplied workspace and then updates the credential record by global id alone, while also rewriting the credential's workspaceId. This allows cross-workspace OAuth credential takeover and reassignment. Version 3.17.0 patches the issue.
AnalysisAI
Cross-workspace OAuth credential takeover in Typebot (open-source chatbot builder) before 3.17.0 lets a user holding only read-collaborator access on a bot read a workspace's OAuth credentialsId and then overwrite that credential by calling handleUpdateOAuthCredentials() with an attacker-controlled writable workspaceId. Because the update authorized only the attacker's supplied workspace but then located and mutated the credential by its global id alone (and rewrote its workspaceId), a low-privilege user in one workspace can seize and reassign OAuth credentials belonging to another workspace. Rated CVSS 9.9; no public exploit identified at time of analysis, though the fixing commit and PR are public.
Technical ContextAI
Typebot is a TypeScript/Next.js visual chatbot builder that stores third-party integration secrets (Google Sheets, OpenAI, and other OAuth providers) as credentials records scoped to a workspace, with role-based collaborator access (read vs. write). The flaw is a textbook CWE-639 Authorization Bypass Through User-Controlled Key: the ORPC handler handleUpdateOAuthCredentials() trusted the client-supplied workspaceId for the authorization check but then resolved the target record by the global credential id alone, decoupling the object being written from the workspace that was actually authorized. The bot configuration readable by a low-privilege collaborator exposes the credentialsId, providing the user-controlled key needed to pivot. Related integration endpoints (handleGetAccessToken, handleListModels) shared the same weak-authorization pattern and were hardened in the same fix by switching from isReadWorkspaceForbidden to isWriteWorkspaceForbidden.
RemediationAI
Vendor-released patch: upgrade to Typebot 3.17.0, which adds an existence/ownership check (prisma.credentials.findUnique scoped by both id and workspaceId, returning NOT_FOUND when the credential does not belong to the supplied workspace) and switches the Google Sheets and OpenAI integration handlers from a read-permission to a write-permission check (isWriteWorkspaceForbidden). Apply via PR #2459 (https://github.com/baptisteArno/typebot.io/pull/2459) and commit 7ae4c007d0987d2ca907b47e1b7418db62b8a157; see advisory GHSA-3788-7276-x4j4. If immediate upgrade is not possible, compensating controls are limited because the flaw is in the authorization logic itself: restrict collaborator invitations and audit who holds read access to bots that reference OAuth credentials, avoid sharing a single instance across untrusted tenants, and rotate/re-authorize any OAuth credentials suspected of reassignment. Note that restricting collaborators reduces shared bot-editing functionality, and credential rotation will temporarily break dependent integrations.
More in Typebot Io
View allServer-Side Request Forgery in Typebot chatbot builder versions 3.15.2 and prior allows unauthenticated remote attackers
Unauthenticated cross-tenant file upload in Typebot.io chatbot builder versions 3.16.1 and earlier allows anonymous visi
Cleartext storage of API bearer tokens in the self-hosted open-source Typebot chatbot builder (version 3.16.1) lets anyo
Stored cross-site scripting in Typebot chatbot builder versions 3.15.2 and prior allows a malicious imported or collabor
Stored cross-site scripting in Typebot (chatbot builder) versions 3.15.2 and prior lets an authenticated user upload a c
Unauthenticated S3 path traversal in Typebot versions prior to 3.17.0 allows any attacker to obtain presigned S3 PUT URL
Server-side request forgery in Typebot chatbot builder before version 3.17.2 allows remote unauthenticated attackers to
Server-side request forgery in Typebot before 3.17.2 lets an authenticated workspace editor or creator bypass the shared
Server-side request forgery in Typebot versions 3.15.2 and prior allows authenticated users to bypass the validateHttpRe
Credential exfiltration in Typebot prior to 3.17.0 allows a low-privilege guest workspace member to steal decrypted Open
Server-side request forgery in Typebot chatbot builder versions prior to 3.16.0 allows authenticated users to bypass SSR
Typebot's webhook resume endpoint exposes an insecure direct object reference flaw that allows any authenticated user ho
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today