CVE-2026-48495

Name of the Vulnerable Software and Affected Versions TypeBot versions prior to 3.17.0

Description The Google Sheets OAuth callback decodes a base64-encoded JSON state parameter and trusts the embedded workspaceId, typebotId, blockId, and redirectUrl without cryptographic integrity protection or authorization checks. Although the callback route is authenticated, it fails to verify if the authenticated user has write access to the target workspace or Typebot before creating credentials or updating Typebot groups. An authenticated user with a valid Google OAuth code can manipulate the state value to create Google Sheets credentials in a different workspace and, provided the target IDs are known, attach those credentials to a block in another Typebot.

Recommendations Update to version 3.17.0.