Authentication Bypass Vulnerability in TypeBot by Baptiste Arno

CVE-2026-48495

What is CVE-2026-48495?

TypeBot, a chatbot builder tool, has a vulnerability linked to its Google Sheets OAuth callback which decodes a base64-encoded JSON 'state' parameter. This process trusts elements such as 'workspaceId', 'typebotId', 'blockId', and 'redirectUrl' without implementing cryptographic integrity checks or proper authorization verification. While the callback route itself is authenticated, it fails to ensure that the authenticated user has the necessary write permissions for the specified workspace or Typebot. As a result, an authenticated user armed with a valid Google OAuth code can manipulate the 'state' parameter to forge Google Sheets credentials in disparate workspaces and subsequently attach these to blocks within other Typebots, creating potential security risks. Users are advised to upgrade to version 3.17.0, where this issue has been addressed.

References