Executive brief
TypeBot is an open-source chatbot builder used to create and manage automated conversational agents. A security flaw in the bot-engine allows any registered user to steal sensitive credentials—such as API keys, OAuth tokens, and SMTP passwords—belonging to other organizations or workspaces. An attacker could use these stolen credentials to access third-party services like OpenAI, Google Sheets, or Stripe, potentially leading to data breaches, financial loss from API quota abuse, and unauthorized access to corporate accounts.
Technical details
An authorization bypass exists in the TypeBot bot-engine due to an incomplete fix for GHSA-4xc5-wfwc-jw47. The root cause is a 'falsy' check in the `getCredentials()` utility function (`if (workspaceId && ...)`). Because the preview endpoint (`/v1/typebots/{typebotId}/preview/startChat`) accepts a client-controlled `workspaceId` and the Zod schema allows empty strings, an attacker can provide an empty string as the `workspaceId`. This causes the ownership verification logic to be skipped entirely. An authenticated attacker can then craft a malicious preview request containing a victim's `credentialsId` to exfiltrate decrypted API keys, OAuth tokens, and secrets via `clientSideActions` in the API response. The vulnerability is patched in version 3.16.0.
Affected products
- baptisteArno TypeBot <= 3.15.2
Timeline
- 2026-04-08: patched: Version 3.16.0 released with fix.
- 2026-05-22: advisory: GHSA-cq66-9cwr-x8jr published.
- 2026-05-22: disclosed: CVE-2026-39968 published.