CVE-2025-64706

Typebot IDOR Vulnerability: Unauthorized API Token Deletion and Exposure

State: Published
Severity: 5.0 Medium
Published: Nov 13, 2025
Updated: Nov 13, 2025
Reserved: Nov 10, 2025

Description

Typebot is an open-source chatbot builder. In version 3.9.0 up to but excluding version 3.13.0, an Insecure Direct Object Reference (IDOR) vulnerability exists in the API token management endpoint. An authenticated attacker can delete any user's API token and retrieve its value by simply knowing the target user's ID and token ID, without requiring authorization checks. Version 3.13.0 fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	5.0 Medium	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L	GitHub_M

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key
CWE-284 Improper Access Control

Affected Products

Product	Versions
typebot.iobaptisteArno	>= 3.9.0, < 3.13.0Affected

References

https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-grx8-g27p-8hpp

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.