CVE-2026-39969— TypeBot: WhatsApp Webhook Endpoint Missing Signature Verification
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| baptisteArno | typebot.io | < 3.17.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-39969
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
TypeBot: WhatsApp Webhook Endpoint Missing Signature Verification
Source: NVD (National Vulnerability Database)
Vulnerability Description
TypeBot is a chatbot builder tool. In versions 3.16.0 and prior, the WhatsApp Cloud API webhook endpoint (POST /v1/workspaces/{workspaceId}/whatsapp/{credentialsId}/webhook) does not verify the x-hub-signature-256 HMAC signature included by Meta in every webhook delivery. The webhook URL exposes both workspaceId and credentialsId as path parameters, which are logged in web server access logs, visible in Meta's webhook configuration dashboard, and potentially shared when configuring integrations. This allows any unauthenticated attacker to send spoofed webhook messages to trigger bot flows, consume API resources, and interact with external services using the workspace owner's credentials. The issue has been fixed in version 3.17.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
认证机制不恰当
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| baptisteArno | typebot.io | < 3.17.0 | - |
II. Public POCs for CVE-2026-39969
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-39969
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-39969 (1)
Vendor Pages for CVE-2026-39969 (1)
- Release v3.17.0 · baptisteArno/typebot.io · GitHubx_refsource_MISC
Same Patch Batch · baptisteArno · 2026-05-22 · 11 CVEs total
| CVE-2026-33712 | 10.0 CRITICAL | TypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF |
| CVE-2026-28445 | 8.7 HIGH | Typebot: Stored XSS via Rating Block Custom Icon Bypasses isUnsafe Sandbox in Builder Prev |
| CVE-2026-39965 | 7.7 HIGH | TypeBot: SSRF via Open Redirect Bypass in HTTP Request and Code Blocks |
| CVE-2026-34207 | 7.6 HIGH | TypeBot: SSRF Protection Bypass via DNS-Resolved Hostnames in Webhook / HTTP Request Valid |
| CVE-2026-39968 | 7.1 HIGH | TypeBot: Cross-Workspace Credential Theft via Bot-Engine Preview Endpoint |
| CVE-2026-28444 | 6.5 MEDIUM | Typebot: IDOR in Result Logs Endpoint Allows Cross-Workspace Data Disclosure |
| CVE-2026-39966 | 6.5 MEDIUM | TypeBot: Async filter() bypasses authorization, allowing IDOR in getLinkedTypebots and lea |
| CVE-2026-39964 | 5.4 MEDIUM | TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on v |
| CVE-2026-39967 | 3.1 LOW | TypeBot: Cross-Typebot Result Data Access via Missing typebotId Filter |
| CVE-2026-39970 | TypeBot: Stored Cross-Site Scripting (XSS) via SVG File Upload On Profile Picture Form |
IV. Related Vulnerabilities
Same product: typebot.io
- CVE-2026-39967
TypeBot: Cross-Typebot Result Data Access via Missing typebo - CVE-2026-39968
TypeBot: Cross-Workspace Credential Theft via Bot-Engine Pre - CVE-2026-39966
TypeBot: Async filter() bypasses authorization, allowing IDO - CVE-2026-39970
TypeBot: Stored Cross-Site Scripting (XSS) via SVG File Uplo - CVE-2026-39965
TypeBot: SSRF via Open Redirect Bypass in HTTP Request and C
Same vendor: baptisteArno
- CVE-2026-39967
TypeBot: Cross-Typebot Result Data Access via Missing typebo - CVE-2026-39968
TypeBot: Cross-Workspace Credential Theft via Bot-Engine Pre - CVE-2026-39966
TypeBot: Async filter() bypasses authorization, allowing IDO - CVE-2026-39970
TypeBot: Stored Cross-Site Scripting (XSS) via SVG File Uplo - CVE-2026-39965
TypeBot: SSRF via Open Redirect Bypass in HTTP Request and C
Same weakness: CWE-287
- CVE-2026-9373
JeecgBoot OpenAPI Endpoint call improper authentication - CVE-2026-47280
Azure Resource Manager Elevation of Privilege Vulnerability - CVE-2026-41076
RT: LDAP authentication bypass via empty password - CVE-2026-32253
Sunshine: Authentication bypass via improper client certific - CVE-2026-44058
Authentication bypass via admin auth user
V. Comments for CVE-2026-39969
No comments yet