CVE-2026-48495: TypeBot Auth Bypass Vulnerability

CVE-2026-48495 Overview

CVE-2026-48495 is a missing authorization vulnerability [CWE-862] in TypeBot, an open-source chatbot builder. In versions prior to 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON state parameter and trusts embedded workspaceId, typebotId, blockId, and redirectUrl values. The callback route authenticates the user but does not verify write access to the target workspace or Typebot. An authenticated attacker with a valid Google OAuth code can tamper with state to plant Google Sheets credentials in another workspace and attach them to blocks in another user's Typebot. Version 3.17.0 patches the flaw.

Critical Impact
Any authenticated TypeBot user can inject Google Sheets OAuth credentials into arbitrary workspaces and hijack integration bindings in other users' Typebots.

Affected Products

TypeBot (baptisteArno/typebot.io) versions prior to 3.17.0
Self-hosted TypeBot builder deployments using the Google Sheets integration
Managed TypeBot instances predating the 3.17.0 release

Discovery Timeline

2026-08-11 - CVE-2026-48495 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-48495

Vulnerability Analysis

The vulnerability resides in the Google Sheets OAuth callback handler in the TypeBot builder application. The callback reads a state value supplied by the OAuth flow, base64-decodes it, and parses a JSON object containing workspaceId, typebotId, blockId, and redirectUrl. The handler then uses these identifiers to write Google Sheets credentials into the referenced workspace and, when applicable, to update the referenced Typebot's group configuration to reference those credentials.

Although the endpoint requires authentication, it never checks whether the authenticated caller has write access to the workspace or Typebot named in state. This is a classic missing authorization failure [CWE-862]. Any authenticated user who can complete a Google OAuth handshake can rewrite the state payload to target another tenant.

Root Cause

The root cause is twofold. First, the state parameter is treated as trusted input despite being fully attacker-controlled, with no cryptographic integrity protection such as an HMAC or a server-side nonce binding. Second, the callback lacks per-request authorization checks against the target workspaceId and typebotId. The patch introduces both an HMAC-signed, nonce-bound state cookie and explicit isWriteWorkspaceForbidden and isWriteTypebotForbidden checks.

Attack Vector

An authenticated attacker initiates a legitimate Google Sheets OAuth flow from their own account, intercepts the OAuth state parameter, and modifies the embedded JSON to reference a workspaceId and typebotId belonging to another tenant. When Google redirects the attacker to the callback with a valid code, TypeBot exchanges the code for tokens and stores the resulting Google Sheets credentials in the victim workspace, optionally attaching them to a block in the victim's Typebot.

typescript

// Patch: apps/builder/src/features/blocks/integrations/googleSheets/api/getAuthorizedGoogleSheetsOAuthResources.ts
+import { ORPCError } from "@orpc/server";
+import prisma from "@typebot.io/prisma";
+import type { User } from "@typebot.io/user/schemas";
+import { isWriteTypebotForbidden } from "@/features/typebot/helpers/isWriteTypebotForbidden";
+import { isWriteWorkspaceForbidden } from "@/features/workspace/helpers/isWriteWorkspaceForbidden";
+
+export const getAuthorizedGoogleSheetsOAuthResources = async ({
+  workspaceId,
+  typebotId,
+  user,
+}: {
+  workspaceId: string;
+  typebotId?: string;
+  user: Pick<User, "id">;
+}) => {
+  const workspace = await prisma.workspace.findFirst({
+    where: { id: workspaceId },
+    select: {
+      id: true,
+      members: { select: { userId: true, role: true } },
+    },
+  });
+
+  if (!workspace || isWriteWorkspaceForbidden(workspace, user))
+    throw new ORPCError("NOT_FOUND", { message: "Workspace not found" });
+
+  if (!typebotId) return { workspace, typebot: null };

Source: GitHub commit c0ffd82

Detection Methods for CVE-2026-48495

Indicators of Compromise

Google Sheets credential records created in a workspace by a userId that is not a member of that workspace.
Updates to Typebot groups that attach Google Sheets credentials owned by, or created by, an external user.
Requests to the Google Sheets OAuth callback route where the decoded stateworkspaceId does not match any workspace the authenticated caller can write to.

Detection Strategies

Audit the TypeBot database for Credentials rows where the creating user has no membership row in the target workspace.
Parse historical web server logs for calls to the Google Sheets OAuth callback and decode the state parameter to look for cross-tenant workspaceId and typebotId values.
Alert on Typebot group edits that add integration credentials shortly after an OAuth callback from a user who lacks write access to that Typebot.

Monitoring Recommendations

Enable application-level audit logging for credential creation and Typebot group mutations, capturing acting user, workspace, and Typebot identifiers.
Forward TypeBot application logs and reverse proxy access logs to a centralized SIEM or data lake for correlation across the OAuth callback and subsequent credential usage.
Review outbound Google Sheets API traffic originating from TypeBot for unexpected spreadsheet targets that may indicate hijacked credentials.

How to Mitigate CVE-2026-48495

Immediate Actions Required

Upgrade all TypeBot builder deployments to version 3.17.0 or later without delay.
Rotate every Google Sheets OAuth credential stored in TypeBot and revoke the corresponding grants in the associated Google Cloud projects.
Review all Typebots for unexpected Google Sheets blocks or credential references and remove any that cannot be attributed to an authorized workspace member.

Patch Information

The fix ships in TypeBot v3.17.0 via pull request #2501 and commit c0ffd82. The patch introduces an HMAC-signed, nonce-bound OAuth state stored in a server-issued cookie and enforces isWriteWorkspaceForbidden and isWriteTypebotForbidden authorization checks before creating credentials or updating Typebot groups. See the GHSA-w789-9gxq-2xcj advisory and v3.17.0 release notes for full details.

Workarounds

If patching is not immediately possible, disable the Google Sheets integration by removing the Google OAuth client credentials from the TypeBot environment configuration.
Restrict TypeBot builder access to a trusted set of authenticated users using upstream network controls until the upgrade is completed.
Monitor and manually review any new Google Sheets credential creation events during the interim period.

bash

# Upgrade TypeBot to the patched release
git fetch --tags
git checkout v3.17.0
pnpm install
pnpm build

# Temporary mitigation: disable the Google Sheets integration
# by unsetting the OAuth client credentials, then restart the builder
unset GOOGLE_SHEETS_CLIENT_ID
unset GOOGLE_SHEETS_CLIENT_SECRET