Executive brief
TypeBot is a no-code chatbot builder platform that stores API credentials (such as OpenAI keys) for workspace members. A guest user with minimal permissions can trick the application into sending their workspace's encrypted OpenAI API keys to an attacker-controlled server by manipulating the API model-listing function. This allows unauthorized exposure of sensitive credentials that control access to external AI services and associated costs.
Technical details
The vulnerability is an authorization bypass combined with credential leakage. The vulnerable OpenAI model-listing endpoint decrypts workspace credentials and creates an API client seeded with the secret, then sends outbound HTTP requests to a caller-supplied `baseUrl` parameter without validating the destination. The permission check only verifies that the user is a workspace member (including low-privilege guests), and the `listCredentials` function inadvertently reveals credential identifiers to guests, enabling them to select a target credential. An attacker with guest-level access can invoke the model-listing helper with an attacker-controlled URL, causing the server to exfiltrate the API key in both the request body and an explicit header. Version 3.17.0 patches the issue by enforcing write-access requirements on the endpoint.
Affected products
- TypeBot TypeBot prior to 3.17.0
Timeline
- 2026-08-11: disclosed
- 2026-04-15: patched: Fix released in version 3.17.0