Passwordless Authentication Vulnerability in Typebot by Baptiste Arno

CVE-2026-62862

What is CVE-2026-62862?

Typebot, an open-source chatbot builder, contains a significant vulnerability in its passwordless email magic-link authentication system. In self-hosted versions 3.17.1 and earlier, the mechanism uses a weak 6-digit code generated by Math.random(), which dramatically reduces the possible combinations. Attackers can exploit this vulnerability by brute-forcing the login codes within a 10-minute expiration window. There are no limits on login attempts or protective measures in place such as CSRF protection. This allows an unauthorized attacker, equipped with the victim's email address, to gain full access to the user's account without their interaction by successfully guessing the authentication codes. The issue was rectified in version 3.18.0, making it crucial for users to upgrade to maintain security.

References