Executive brief
Typebot, a popular chatbot builder platform, contains a vulnerability that allows attackers to steal all stored API credentials from users. When a victim previews a malicious chatbot, arbitrary JavaScript code executes in their browser with their authenticated session, enabling theft of OpenAI keys, Google Sheets tokens, SMTP passwords, and other sensitive credentials stored in the platform. Combined with an API authorization bypass, attackers can retrieve plaintext credentials belonging to any user without ownership verification.
Technical details
The vulnerability comprises two components. First, the Script block with "Execute on client" enabled runs arbitrary JavaScript in the victim's browser within their authenticated session context, allowing API calls on their behalf. Second, the `/api/trpc/credentials.getCredentials` endpoint returns plaintext API keys and tokens after checking only authentication status, not credential ownership—any authenticated user can retrieve any credential by iterating credential IDs. The root causes are inadequate input sanitization in client-side script execution, missing access control checks in the credentials endpoint, and lack of user warnings. Exploitation requires minimal privileges (free tier sufficient) and only user interaction to preview a malicious bot. Attack vectors are network-based, and the impact is high: full compromise of all stored credentials including third-party API keys and authentication tokens. A patch was released in version 3.13.2; vulnerable versions are 3.13.1 and earlier.
Affected products
- Typebot Typebot <=3.13.1
Timeline
- 2026-01-22: disclosed
- 2026-01-22: patched: Fixed in version 3.13.2