CVE-2026-48762

Name of the Vulnerable Software and Affected Versions TypeBot versions prior to 3.16.0

Description The OpenAI Create Transcription action handler uses the fetch() function to retrieve a user-supplied audio URL without implementing existing Server-Side Request Forgery (SSRF) protections. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. This allows an attacker to force the server to send HTTP requests to localhost or arbitrary internal addresses. The retrieved content is then sent to the OpenAI Whisper API, and the resulting transcription is returned to the attacker.

Recommendations Update to version 3.16.0.