CVE-2026-39969 describes an improper authentication vulnerability (CWE-287) in the TypeBot chatbot builder tool (versions ≤ 3.16.0). The WhatsApp Cloud API webhook endpoint (POST /v1/workspaces/{workspaceId}/whatsapp/{credentialsId}/webhook) fails to verify the x-hub-signature-256 HMAC signature provided by Meta, allowing unauthenticated attackers to send spoofed webhook messages. The webhook URL includes workspaceId and credentialsId as path parameters, which are logged and visible in Meta's webhook configuration dashboard, increasing exposure risk. Exploitation enables attackers to trigger bot flows, consume API resources, and interact with external services under the workspace owner's credentials. This vulnerability has been addressed in TypeBot version 3.17.0.

An attacker can send unauthenticated spoofed webhook messages to the affected endpoint, potentially triggering bot workflows and causing unintended interactions with external services using the workspace owner's credentials. This may lead to unauthorized actions and resource consumption. The confidentiality and integrity of the webhook interactions are compromised due to lack of signature verification. There is no indication of availability impact. No known exploits are reported in the wild.

Upgrade TypeBot to version 3.17.0 or later, where this vulnerability is fixed by verifying the x-hub-signature-256 HMAC signature on incoming webhook requests. Until upgraded, be aware that webhook endpoints do not authenticate incoming requests properly, and consider restricting network access to trusted sources if possible. Patch status is not explicitly stated as 'official-fix' in the advisory, but the fix is included in version 3.17.0. No vendor advisory content was provided to override this guidance.