Typebot IDOR Vulnerability: Unauthorized API Token Deletion and Exposure
Priority HIGH 66CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.
Summary
Typebot is an open-source chatbot builder. In version 3.9.0 up to but excluding version 3.13.0, an Insecure Direct Object Reference (IDOR) vulnerability exists in the API token management endpoint. An authenticated attacker can delete any user's API token and retrieve its value by simply knowing the target user's ID and token ID, without requiring authorization checks. Version 3.13.0 fixes the issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0025 16th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed typebot.io (baptisteArno): 3.13.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| baptisteArno | typebot.io | 3.9.0 to before 3.13.0 | 3.13.0 | Patch available | CNA |
- typebot.io VendorbaptisteArno Affected 3.9.0 to before 3.13.0 Fixed in 3.13.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:typebot:typebot:*:*:*:*:*:-:*:* | 3.9.0 to before 3.13.0 | Vulnerable | baptisteArno |
- cpe:2.3:a:typebot:typebot:*:*:*:*:*:-:*:* Versions 3.9.0 to before 3.13.0 Vulnerable ·baptisteArno
Remediation
- Fix · CNA typebot.io (baptisteArno) Fixed in 3.13.0
Timeline
- 2026-10-02 Threatist record created from CVE-2025-64706
References
More baptisteArno Typebot vulnerabilities
- TI-2025-40055 Typebot May Expose AWS EKS Credentials via Server Side Request Forgery in Webhook Block CVSS 3.1CRITICAL 9.9
- TI-2024-20010 typebot.io: `GHSL-2024-040` CVSS 3.1CRITICAL 9.3
- TI-2025-40251 Typebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization Bypass CVSS 3.1HIGH 7.4
- TI-2021-07182 Typebot < 1.4.3 - Admin+ Stored Cross Site Scripting CVSS 3.1MEDIUM 4.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences