CVE-2026-48494: TypeBot Auth Bypass Vulnerability

CVE-2026-48494 Overview

CVE-2026-48494 is an authorization bypass vulnerability in TypeBot, an open-source chatbot builder tool. The flaw affects version 3.16.1 and allows an authenticated user with read access to any typebot to hijack a WhatsApp preview webhook session belonging to a different typebot. The WhatsApp test-webhook handler authorizes the parent typebotId correctly but resolves the preview chat session using only the wa-preview-{phone} key. An attacker can inject arbitrary webhook JSON into another workspace's WhatsApp preview session and advance its draft flow. The issue is classified under [CWE-639] Authorization Bypass Through User-Controlled Key. Version 3.17.0 patches the vulnerability.

Critical Impact
Authenticated attackers can inject webhook payloads into unrelated workspaces' WhatsApp preview sessions and manipulate draft or unpublished chatbot flows without holding access to the victim typebot.

Affected Products

TypeBot version 3.16.1
TypeBot WhatsApp preview webhook handler (handleStartWhatsAppPreview.ts)
Fixed in TypeBot version 3.17.0

Discovery Timeline

2026-08-11 - CVE-2026-48494 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-48494

Vulnerability Analysis

The vulnerability resides in the WhatsApp preview webhook handler within the TypeBot backend. When a user initiates a WhatsApp preview session, the handler validates that the requester has access to the supplied typebotId and blockId. However, the session lookup that follows uses a separate key derived only from the phone number: wa-preview-{phone}. This decoupling of authorization from session resolution creates a confused-deputy condition. An attacker submits an authorized typebotId/blockId pair alongside a phone number that belongs to another workspace's preview session. The handler accepts the request and applies the resulting webhook state to the foreign session.

Root Cause

The root cause is an authorization bypass through a user-controlled key [CWE-639]. The preview session identifier is constructed from the caller-supplied phone number rather than from the authorized typebot context. As a result, session ownership is never verified against the authenticated principal. The design assumes that a valid typebotId implies ownership of any session tied to the submitted phone number, which does not hold.

Attack Vector

The attack requires network access and low-privileged authentication to the TypeBot instance. The attacker must know or guess a preview phone number tied to a victim's active preview session. The attacker then calls the WhatsApp preview start endpoint with their own authorized typebotId and blockId and the victim's phone number. The handler routes the injected webhook JSON into the victim's session, advancing its unpublished flow with attacker-controlled data.

typescript

// Security patch in packages/whatsapp/src/api/handleStartWhatsAppPreview.ts
// Fix WhatsApp preview webhook authorization (#2499)
 import { sendChatReplyToWhatsApp } from "@typebot.io/whatsapp/sendChatReplyToWhatsApp";
 import { sendWhatsAppMessage } from "@typebot.io/whatsapp/sendWhatsAppMessage";
 import { z } from "zod";
+import { WHATSAPP_PREVIEW_SESSION_ID_PREFIX } from "../constants";
+import { normalizeWhatsAppPreviewPhoneNumber } from "../normalizeWhatsAppPreviewPhoneNumber";

 export const startWhatsAppPreviewInputSchema = z.object({
-  to: z
-    .string()
-    .min(1)
-    .transform((value) =>
-      value.replace(/\s/g, "").replace(/\+/g, "").replace(/-/g, ""),
-    ),
+  to: z.string().min(1).transform(normalizeWhatsAppPreviewPhoneNumber),
   typebotId: z.string(),
   startFrom: startFromSchema.optional(),
 });

Source: GitHub Commit 36a6186. The patch centralizes phone number normalization and ties preview session identifiers to a validated prefix so that session lookup aligns with the authorized typebot context.

Detection Methods for CVE-2026-48494

Indicators of Compromise

Requests to the WhatsApp preview start endpoint where the submitted typebotId and the resolved session's owning typebot do not match.
Multiple preview session start events for the same phone number originating from distinct authenticated users within a short window.
Unexpected state transitions in draft or unpublished flows without a corresponding editor action from the flow owner.
Application logs referencing wa-preview-{phone} sessions being written by users outside the owning workspace.

Detection Strategies

Correlate authenticated user identity with the workspace ownership of any WhatsApp preview session the request updates.
Alert on anomalous cross-workspace access patterns against handleStartWhatsAppPreview and related webhook endpoints.
Ingest TypeBot application and access logs into a centralized analytics pipeline to enable behavioral baselining of preview usage.

Monitoring Recommendations

Enable verbose logging on the TypeBot API layer to capture typebotId, blockId, phone number, and requester identity for every preview call.
Monitor version banners and container images to identify hosts still running TypeBot 3.16.1 or earlier.
Track outbound WhatsApp API activity from TypeBot to detect unexpected preview traffic to numbers not owned by the initiating workspace.

How to Mitigate CVE-2026-48494

Immediate Actions Required

Upgrade all TypeBot deployments to version 3.17.0 or later without delay.
Audit user accounts with read access to any typebot and remove unused or overprovisioned accounts.
Review recent WhatsApp preview session logs for signs of cross-workspace access matching the indicators above.
Rotate any secrets or webhook tokens that may have been exposed through injected preview payloads.

Patch Information

The fix is available in TypeBot 3.17.0. See the GitHub Release v3.17.0, the GitHub Pull Request #2499, and the GitHub Security Advisory GHSA-fqf7-mmp5-j3jq. The patch normalizes preview phone numbers through a shared helper and binds session identifiers to a validated prefix, so session resolution aligns with the authorized typebot context.

Workarounds

Restrict TypeBot access to trusted users only until the upgrade completes.
Disable the WhatsApp preview feature at the deployment level if the upgrade cannot be applied immediately.
Place the TypeBot API behind a reverse proxy that enforces stricter rate limits on preview endpoints.
Isolate workspaces onto separate TypeBot instances where multi-tenant risk is unacceptable.

bash

# Upgrade TypeBot to the patched release
git fetch --tags
git checkout v3.17.0

# Docker-based deployments
docker pull baptistearno/typebot-builder:3.17.0
docker pull baptistearno/typebot-viewer:3.17.0
docker compose up -d

# Verify running version
curl -s https://<typebot-host>/api/health | grep -i version