TypeBot OAuth Credential Takeover via Low-Privilege Collaborator

Executive Summary

A critical privilege escalation and credential takeover vulnerability has been identified in TypeBot, a popular open-source chatbot builder. Tracked as CVE-2026-48765 with a near-perfect CVSS score of 9.9, the flaw allows a low-privilege read collaborator to extract a workspace's OAuth credentialsId from a readable bot configuration and then overwrite the underlying credential by exploiting an improperly access-controlled API function (handleUpdateOAuthCredentials()).

Organizations and SaaS operators running TypeBot self-hosted instances below version 3.17.0 are at severe risk of complete credential takeover by any user with even minimal collaboration access.

Vulnerability Details

Technical Analysis

The Attack Chain

TypeBot's collaboration model allows workspace owners to invite external users with varying permission levels, including read-only collaborators who are expected to only view bot configurations — not modify them.

The vulnerability exploits a two-stage flaw:

Stage 1 — Credential ID Extraction

A read collaborator can access bot configuration data through their legitimately granted read access. Within this configuration, the OAuth credentialsId — a reference to the workspace's stored OAuth credential — is exposed in plaintext.

Stage 2 — Unauthorized Credential Overwrite

The handleUpdateOAuthCredentials() function, which is responsible for updating OAuth credentials, does not enforce the caller's permission level before processing requests. A read collaborator can call this function directly, supplying the extracted credentialsId alongside attacker-controlled credential data.

The result: the workspace's OAuth credential is silently replaced with one under the attacker's control.

Consequences of Exploitation

After a successful exploit, the attacker's credential is substituted for the legitimate OAuth token. Depending on which OAuth integration the credential belongs to, this can result in:

• Email account compromise (Gmail, Outlook OAuth integrations)
• CRM/sales platform access (HubSpot, Salesforce OAuth)
• Cloud service impersonation (Google Workspace, Microsoft 365)
• Bot traffic interception — bot conversations routed through attacker-controlled OAuth sessions
• Persistence — the attacker can continue using the compromised credential even after losing collaborator access, since the underlying OAuth token now belongs to them

The near-perfect CVSS score reflects the low privilege bar required combined with the catastrophic, workspace-wide impact.

Affected Products

Recommended Actions

Immediate Steps

1. Upgrade immediately: Update TypeBot to version 3.17.0 or later — this is the only complete fix
2. Audit collaborator lists: Review all workspace collaborators and remove any untrusted or unnecessary read-level access
3. Rotate OAuth credentials: For all TypeBot workspaces, revoke and re-authorize any OAuth integrations, as existing credentials may already be compromised
4. Check OAuth provider logs: Review activity logs for connected OAuth applications (Google, Microsoft, HubSpot, etc.) for unexpected access patterns

Workaround (Pre-patch)

If immediate upgrading is not possible:

• Remove all external collaborators from workspaces that have OAuth credentials configured
• Disable OAuth integrations temporarily until the patch can be applied
• Restrict TypeBot network access to trusted internal networks

Disclosure Timeline

References

• NVD Entry: CVE-2026-48765
• TypeBot GitHub Repository
• TypeBot Releases