CVE-2026-47702 TypeBot API tokens stored in plaintext
Attackers with database read access can extract plaintext API tokens to impersonate users and bypass authentication in TypeBot.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-47702?
CVE-2026-47702 is a critical vulnerability in baptisteArno typebot.io, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TypeBot is a chatbot builder tool. In version 3.16.1, API tokens (bearer credentials used to authenticate against the builder API) are stored in the database as cleartext strings. An attacker who gains read access to the database (e.g., via SQL injection, backup exposure, or insider access) can extract all API tokens and impersonate any user without requiring a password or multi-factor authentication. Version 3.17.0 fixes the issue.
Weakness: CWE-312
Which versions are affected by CVE-2026-47702?
How do I fix CVE-2026-47702?
No fix has been published for CVE-2026-47702 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-47702 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47702 exists.
Sources
Also known as GHSA-9c96-gcg3-2662.