CVE-2026-47702
TypeBot API tokens stored in plaintext
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
TypeBot is a chatbot builder tool. In version 3.16.1, API tokens (bearer credentials used to authenticate against the builder API) are stored in the database as cleartext strings. An attacker who gains read access to the database (e.g., via SQL injection, backup exposure, or insider access) can extract all API tokens and impersonate any user without requiring a password or multi-factor authentication. Version 3.17.0 fixes the issue.
| CWE | CWE-312 |
| Vendor | baptistearno |
| Product | typebot.io |
| Published | Aug 11, 2026 |
| Last Updated | Aug 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for baptistearno typebot.io
Be the first to know when new unknown vulnerabilities affecting baptistearno typebot.io are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
baptisteArno / typebot.io
= 3.16.1
References
github.com: https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-9c96-gcg3-2662 github.com: https://github.com/baptisteArno/typebot.io/pull/2492 github.com: https://github.com/baptisteArno/typebot.io/commit/fdcc1784c9318904c180703e1ef4f1e06e6dd50e github.com: https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0