Executive brief
Typebot is an open-source chatbot builder that allows passwordless email login for users to access and manage their chatbots. In self-hosted versions up to 3.17.1, the default email-based magic link authentication is vulnerable to brute-force attacks that bypass login entirely. An attacker can guess the 6-digit verification code without rate limiting and gain full access to a victim's account, bots, chat results, and connected integrations—no password or user action required, only knowledge of the victim's email address.
Technical details
The vulnerability is a credential enumeration and authentication bypass in the email magic-link login flow. The root cause is a weak token generation mechanism: instead of using NextAuth's cryptographically secure tokens, the email provider generates a 6-digit code using Math.random(), reducing the keyspace to 900,000 possibilities. The verification callback enforces no attempt limits, account lockouts, or CSRF protection. When an incorrect guess is made, the backend returns null instead of consuming the valid code, allowing unlimited guesses within the 10-minute expiry window. Additionally, the rate limiter on code-sending is keyed to the client-controlled X-Forwarded-For header, allowing an attacker to bypass it by spoofing the header or rotating IPs and request multiple concurrent codes for one victim. An anonymous attacker can systematically brute-force the 6-digit code and obtain an authenticated session. This issue is fixed in version 3.18.0 by hardening codes with cryptographically secure generation, tracking failed attempts, locking accounts after 5 failures, and adding proper rate-limiting logic.
Affected products
- Baptiste Arnaud Typebot up to and including 3.17.1
Timeline
- 2026-08-25: disclosed
- 2026-08-21: patched: Version 3.18.0 released on 2026-08-21 with hardened email login codes