CVE-2025-65098 - CVE House
Back to Database
Status published High CVE-2025-65098

Typebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization Bypass

Vulnerability Description

Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any user. When a victim previews a malicious typebot by clicking "Run", JavaScript executes in their browser and exfiltrates their OpenAI keys, Google Sheets tokens, and SMTP passwords. The `/api/trpc/credentials.getCredentials` endpoint returns plaintext API keys without verifying credential ownership. Version 3.13.2 fixes the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-65098

Credits & Attribution

No credits recorded in the NVD database.

References

More from baptisteArno

View All →
CVE-2025-64709
Typebot May Expose AWS EKS Credentials via Server Side Request Forgery in Webhook Block
Critical 9.6
CVE-2025-64706
Typebot IDOR Vulnerability: Unauthorized API Token Deletion and Exposure
Medium 5
CVE-2024-30264
typebot.io: `GHSL-2024-040`
High 8.1

Affected Vendor

baptisteArno

View all reports →

Affected Software

typebot.io
Vulnerable Versions:
< 3.13.2

Timeline

Official Publish: January 22nd, 2026
Last Modified: January 22nd, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Weaknesses (CWE)

CWE-79 CWE-200 CWE-284 CWE-311 CWE-522 CWE-639 CWE-862

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration
T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1078 Valid Accounts
Persistence
T1565.002 Stored Data Manipulation
Impact
T1040 Network Sniffing
Credential Access
T1530 Data from Cloud Storage
Collection
T1555 Credentials from Password Stores
Credential Access
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Privilege Escalation
T1531 Account Access Removal
Impact