CVE-2026-62862: Typebot email login code brute-force to account takeover

CVE-2026-62862 · Severity: info · Published 2026-08-25

Typebot is an open-source chatbot builder that allows passwordless email login for users to access and manage their chatbots. In self-hosted versions up to 3.17.1, the default email-based magic link authentication is vulnerable to brute-force attacks that bypass login entirely. An attacker can guess the 6-digit verification code without rate limiting and gain full access to a victim's account, bots, chat results, and connected integrations—no password or user action required, only knowledge of the victim's email address.

Quick answers

Is CVE-2026-62862 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-62862 being exploited in the wild.
How severe is CVE-2026-62862?
Informational severity, published 25 August 2026.
Which products and versions are affected?
Baptiste Arnaud Typebot up to and including 3.17.1.
Is there a fix for CVE-2026-62862?
A patch was published on 2026-08-21: Version 3.18.0 released on 2026-08-21 with hardened email login codes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62862 attacked?
It is attacked over the network.
Am I affected by CVE-2026-62862?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a credential enumeration and authentication bypass in the email magic-link login flow. The root cause is a weak token generation mechanism: instead of using NextAuth's cryptographically secure tokens, the email provider generates a 6-digit code using Math.random(), reducing the keyspace to 900,000 possibilities. The verification callback enforces no attempt limits, account lockouts, or CSRF protection. When an incorrect guess is made, the backend returns null instead of consuming the valid code, allowing unlimited guesses within the 10-minute expiry window. Additionally, the rate limiter on code-sending is keyed to the client-controlled X-Forwarded-For header, allowing an attacker to bypass it by spoofing the header or rotating IPs and request multiple concurrent codes for one victim. An anonymous attacker can systematically brute-force the 6-digit code and obtain an authenticated session. This issue is fixed in version 3.18.0 by hardening codes with cryptographically secure generation, tracking failed attempts, locking accounts after 5 failures, and adding proper rate-limiting logic.

Affected products

  • Baptiste Arnaud Typebot up to and including 3.17.1

Timeline

  • 2026-08-25: disclosed
  • 2026-08-21: patched: Version 3.18.0 released on 2026-08-21 with hardened email login codes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.