CVE-2026-62862: Typebot Authentication Bypass Vulnerability

CVE-2026-62862 Overview

Typebot, an open-source chatbot builder, contains a critical authentication flaw in self-hosted deployments up to and including version 3.17.1. The default passwordless email magic-link authentication is vulnerable to login-code brute forcing that leads to full account takeover [CWE-307]. The email provider overrides NextAuth's cryptographically secure token with a 6-digit code generated using Math.random(), reducing the keyspace to 900,000 within a 10-minute expiry window. An anonymous attacker who knows a victim's email address can brute-force the callback and obtain an authenticated session without any victim interaction. The issue is fixed in version 3.18.0.

Critical Impact
Anonymous attackers gain full access to victim bots, results, and connected integration credentials by brute-forcing 6-digit codes with no lockout or attempt limit.

Affected Products

Typebot self-hosted deployments through version 3.17.1
Instances using the default email magic-link authentication provider
Deployments configured for OAuth or SSO only (no email provider) are NOT affected

Discovery Timeline

2026-08-25 - CVE-2026-62862 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-62862

Vulnerability Analysis

The vulnerability chains multiple weaknesses in Typebot's email authentication flow. The custom email provider replaces NextAuth's default secure token generation with a 6-digit numeric code produced by Math.random(). This code is placed as the raw value in the magic link and stored for verification. The verification callback lacks any attempt counter, account lockout, or CSRF protection.

Critically, the Prisma adapter returns null when a submitted code is not found, so incorrect guesses do not consume or invalidate the real code. A valid code therefore survives unlimited guessing attempts throughout its 10-minute lifetime. The only rate limiter applies to the code-sending endpoint and is keyed on the client-controlled X-Forwarded-For header, allowing trivial bypass by header rotation.

Root Cause

The root cause is improper restriction of excessive authentication attempts [CWE-307] combined with weak token generation. Math.random() is not cryptographically secure, and the 900,000-entry keyspace is small enough to enumerate concurrently. Rate limiting keyed on a client-supplied header provides no meaningful protection against a determined attacker.

Attack Vector

An attacker who knows the victim's email address triggers many concurrent magic-link requests while rotating the X-Forwarded-For header to defeat rate limiting. Each request creates an additional live code, raising the probability of a matching guess. The attacker then submits high volumes of 6-digit codes to the verification callback. Because failed guesses do not decrement or invalidate live codes, brute forcing continues until a match is found, at which point an authenticated session is established as the victim.

typescript

// Fix introduced in packages/auth/src/helpers/createAuthPrismaAdapter.ts
import { convertInvitationsToCollaborations } from "./convertInvitationsToCollaborations";
import { getNewUserInvitations } from "./getNewUserInvitations";
import { joinWorkspaces } from "./joinWorkspaces";
import {
  EMAIL_SIGN_IN_VERIFICATION_TOKEN_VALUE,
  recordFailedEmailSignInAttempt,
} from "./recordFailedEmailSignInAttempt";
// Source: https://github.com/baptisteArno/typebot.io/commit/03c8dd967f21e48e128340e369901d595d89bfd9

The patch introduces recordFailedEmailSignInAttempt to track and limit failed verification attempts, closing the unlimited-guess window.

Detection Methods for CVE-2026-62862

Indicators of Compromise

High volumes of POST requests to the NextAuth email verification callback endpoint from a single or distributed source
Multiple concurrent magic-link generation requests targeting the same victim email address within a short time window
Requests with varied or clearly forged X-Forwarded-For header values against the sign-in endpoint
Successful authentication events immediately preceded by failed verification attempts against the same account

Detection Strategies

Alert on repeated 4xx responses from the email verification callback followed by a 200 or session issuance for the same account
Baseline normal magic-link request rates per user and flag deviations exceeding 10x baseline
Correlate X-Forwarded-For header entropy with authentication endpoint hits to identify header rotation abuse

Monitoring Recommendations

Enable verbose authentication logging on the Typebot NextAuth flow, capturing source IP, X-Forwarded-For, and verification outcome
Forward authentication and reverse-proxy logs to a centralized analytics platform for correlation and long-term retention
Monitor for post-authentication actions such as new integration credential access or bot exports immediately after suspicious sign-in patterns

How to Mitigate CVE-2026-62862

Immediate Actions Required

Upgrade Typebot self-hosted deployments to version 3.18.0 or later without delay
Rotate credentials for any third-party integrations connected to Typebot workspaces suspected of compromise
Audit recent authentication logs for signs of brute-force activity against the email verification endpoint
Invalidate active sessions after upgrading to force re-authentication of all users

Patch Information

The vulnerability is fixed in Typebot version 3.18.0. See the GitHub Release v3.18.0, the fix commit 03c8dd9, and the GitHub Security Advisory GHSA-4g76-cwmg-gqgw. The patch introduces recordFailedEmailSignInAttempt logic to enforce attempt limits on the verification callback.

Workarounds

Disable the email magic-link provider and configure OAuth or SSO providers only, which are not affected by this vulnerability
Place the Typebot deployment behind a reverse proxy or WAF that rate limits the verification callback by trusted source IP rather than the X-Forwarded-For header
Restrict access to the Typebot authentication endpoints via IP allowlisting where feasible

bash

# Upgrade self-hosted Typebot to the patched release
docker pull baptistearno/typebot-builder:3.18.0
docker pull baptistearno/typebot-viewer:3.18.0
docker compose up -d