API Token Exposure in TypeBot Chatbot Builder

CVE-2026-47702

What is CVE-2026-47702?

In TypeBot version 3.16.1, sensitive API tokens used for authentication against the builder API are stored in the database as cleartext strings. This vulnerability enables an attacker, who gains read access to the database through methods such as SQL injection, backup exposure, or insider threats, to extract all API tokens. As a result, the attacker can impersonate any user without the need for passwords or multi-factor authentication, significantly compromising the security and integrity of user accounts. The issue has been addressed in version 3.17.0.

References