CVE-2026-62862 in Typebot
Summary
by MITRE • 08/26/2026
Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vulnerable to login-code brute forcing that leads to account takeover. The email provider overrides NextAuth's default cryptographically secure token with a 6-digit code generated using Math.random(), reducing the keyspace to 900,000 with a 10-minute expiry, and the code itself is the raw value placed in the magic link. The verification callback enforces no attempt limit, lockout, or CSRF protection, and an incorrect guess does not consume the real code because the adapter returns null on a not-found token, so a valid code survives unlimited guessing within its lifetime. The only rate limiter applies to the code-sending path and is keyed on the client-controlled X-Forwarded-For header, allowing an attacker to request many concurrent live codes for one victim and further raise the odds of a matching guess. As a result, an anonymous attacker who knows a victim's email address can brute-force the callback and obtain an authenticated session as that user with no victim interaction, gaining full access to the victim's bots, results, and connected integration credentials. Deployments configured for OAuth or SSO only, with no email provider, are not affected. This issue is fixed in version 3.18.0
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified in self-hosted instances of Typebot up to version 3.17.1 represents a critical authentication bypass resulting from the misuse of pseudo-random number generation and insufficient access control mechanisms within its passwordless email magic-link implementation. The core technical flaw lies in the replacement of NextAuth's default cryptographically secure token with a six-digit numeric code generated using JavaScript's Math.random function. This specific algorithm is not designed for security purposes as it produces predictable sequences based on internal state rather than entropy, effectively reducing the authentication keyspace to approximately 900,000 possible values. When combined with a ten-minute expiration window, this limited entropy creates an attack surface that is trivially exploitable through brute-force methods without requiring any specialized tools or significant computational resources.
The operational impact of this flaw allows an anonymous attacker who possesses the victim's email address to perform an unauthenticated account takeover. The verification callback logic contains multiple critical weaknesses that facilitate this exploitation. First, there are no rate limits applied to the code verification endpoint itself, nor is there any mechanism for lockout after failed attempts or protection against Cross-Site Request Forgery attacks. Crucially, the adapter returns null when a token is not found rather than consuming the attempt count associated with a valid but incorrect guess. This behavior means that an attacker can submit thousands of guesses within the ten-minute validity period without invalidating the actual magic link code. Consequently, if any submitted six-digit sequence matches the live code generated for the victim's session, the system grants full authenticated access to the account.
The attack is further amplified by a flawed rate-limiting implementation on the initial request path that sends the magic links. This limiter relies exclusively on the X-Forwarded-For header to identify unique clients, which is easily spoofable since it is controlled entirely by the attacker. By manipulating this header, an adversary can bypass per-user limits and trigger the generation of multiple concurrent live codes for a single victim email address within a short timeframe. This strategy significantly increases the probability of a successful brute-force match during any given ten-minute window, effectively turning a low-probability guess into a near-certainty with minimal effort. The result is that an attacker gains full control over the victim's workspace, including access to all created bots, historical interaction results, and sensitive credentials linked to third-party integrations.
This vulnerability maps directly to CWE-330: Use of Insufficiently Random Values due to the reliance on Math.random for security-critical tokens, as well as CWE-798: Use of Hard-coded Credentials if one considers the static nature of the weak algorithmic approach across deployments. From a tactical perspective, it aligns with MITRE ATT&CK technique T1078: Valid Accounts and specifically sub-technique T1078.003: Cloud Accounts, as it involves hijacking legitimate cloud-based service credentials through authentication bypass rather than credential theft or exploitation of software vulnerabilities in the traditional sense. The attack does not require any interaction from the victim beyond having their email address known to the attacker, making it a high-severity remote unauthenticated access issue that compromises confidentiality and integrity of user data.
Mitigation strategies must focus on replacing non-cryptographic random number generators with secure alternatives such as crypto.getRandomValues or similar OS-level entropy sources for all authentication tokens. Implementing strict rate limiting on both the token generation and verification endpoints is essential to prevent brute-force attacks, ensuring that limits are tied to immutable identifiers like IP addresses or session IDs rather than spoofable headers. Additionally, introducing account lockout mechanisms after a small number of failed attempts and enforcing CSRF protections on state-changing actions would significantly raise the barrier for attackers. Organizations running self-hosted Typebot must immediately upgrade to version 3.18.0 where these issues have been addressed. Deployments that rely exclusively on OAuth or Single Sign-On providers without using the email magic-link feature are not susceptible to this specific vector and do not require immediate patching, though general security hygiene should still be maintained across all authentication methods.