CVE-2025-64706 - CVE House
Back to Database
Status published Medium CVE-2025-64706

Typebot IDOR Vulnerability: Unauthorized API Token Deletion and Exposure

Vulnerability Description

Typebot is an open-source chatbot builder. In version 3.9.0 up to but excluding version 3.13.0, an Insecure Direct Object Reference (IDOR) vulnerability exists in the API token management endpoint. An authenticated attacker can delete any user's API token and retrieve its value by simply knowing the target user's ID and token ID, without requiring authorization checks. Version 3.13.0 fixes the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64706

Credits & Attribution

No credits recorded in the NVD database.

References

More from baptisteArno

View All →
CVE-2025-65098
Typebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization Bypass
High 7.4
CVE-2025-64709
Typebot May Expose AWS EKS Credentials via Server Side Request Forgery in Webhook Block
Critical 9.6
CVE-2024-30264
typebot.io: `GHSL-2024-040`
High 8.1

Affected Vendor

baptisteArno

View all reports →

Affected Software

typebot.io
Vulnerable Versions:
>= 3.9.0, < 3.13.0

Timeline

Official Publish: November 13th, 2025
Last Modified: November 13th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-639 CWE-284

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1213 Data from Information Repositories
Collection
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1565.002 Stored Data Manipulation
Impact