A critical authorization bypass vulnerability in Typebot.io allows authenticated low-privilege users to compromise and reassign OAuth credentials across workspaces.

This is an authorization flaw (CWE-639) where the application fails to adequately validate workspace ownership during credential updates. An authenticated low-privilege collaborator can exploit this to overwrite OAuth credentials by manipulating the workspace identifier, leading to unauthorized access to external services.

Successful exploitation allows an attacker to hijack OAuth credentials, granting them unauthorized access to third-party services integrated with the target workspace. Given the CVSS score of 9.9, this poses a severe risk to data confidentiality and integrity, potentially leading to widespread account compromise and unauthorized data exfiltration.

Immediate Action: Update baptisteArno typebot.io to version 3.17.0 or later immediately.

Proactive Monitoring: Review audit logs for unusual activities related to OAuth credential modifications or unexpected workspace configuration changes.

Compensating Controls: Implement strict access control reviews to ensure users only have the minimum necessary privileges within their assigned workspaces.

Public Exploit Available: Unknown

This vulnerability represents a critical security failure in access control logic. Administrators must prioritize updating to version 3.17.0 to eliminate the risk of cross-workspace credential takeover. Failure to patch allows even low-privileged users to escalate their access and potentially compromise external service integrations.