CVE-2026-62862: CWE-307: Improper Restriction of Excessive Authentication Attempts in baptisteArno typebot.io

Typebot.io, an open-source chatbot builder, uses a passwordless email magic-link authentication mechanism that in self-hosted versions up to 3.17.1 is vulnerable to brute force attacks. The email provider replaces NextAuth's secure token with a 6-digit code generated by Math.random(), limiting the keyspace to 900,000 codes valid for 10 minutes. The verification process lacks attempt limits, lockout, and CSRF protections, and incorrect guesses do not invalidate the real code, allowing unlimited guessing within the code's lifetime. Rate limiting is only applied to code sending and is keyed on the client-controlled X-Forwarded-For header, which can be manipulated to request many codes for a victim, increasing brute force success chances. An attacker knowing a victim's email can gain authenticated sessions and full access to the victim's bots and credentials. Deployments using only OAuth or SSO without email providers are unaffected. The vulnerability is fixed in version 3.18.0.

An unauthenticated attacker who knows a victim's email address can brute-force the 6-digit login code due to weak randomness and lack of attempt restrictions, leading to account takeover. This grants full access to the victim's chatbot configurations, results, and connected integration credentials. The vulnerability affects self-hosted Typebot.io instances using passwordless email authentication up to version 3.17.1. Deployments configured for OAuth or SSO only are not impacted.

Upgrade Typebot.io to version 3.18.0 or later, where this vulnerability is fixed. Until upgraded, deployments configured for OAuth or SSO only without email providers are not affected. No other effective mitigations are described. Patch status is confirmed fixed in 3.18.0.