CVE-2026-62862

Name of the Vulnerable Software and Affected Versions Typebot versions prior to 3.18.0

Description Self-hosted installations using default passwordless email magic-link authentication are susceptible to login-code brute forcing, which can lead to account takeover. The system replaces the standard cryptographically secure token with a 6-digit code generated via Math.random(), limiting the keyspace to 900,000 possibilities with a 10-minute expiration. The verification callback lacks attempt limits, lockout mechanisms, and CSRF (Cross-Site Request Forgery) protection. Furthermore, incorrect guesses do not invalidate the actual code. The existing rate limiter for sending codes relies on the X-Forwarded-For header, which is client-controlled, allowing an attacker to request multiple concurrent codes for a single victim to increase the probability of a successful guess. An attacker knowing a victim's email can gain an authenticated session and full access to bots, results, and integration credentials without user interaction. Deployments using only OAuth or SSO are not affected.

Recommendations Update to version 3.18.0.