CVE-2025-65098
- EPSS 0.02%
- Veröffentlicht 22.01.2026 14:59:20
- Zuletzt bearbeitet 30.01.2026 14:32:00
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
LoginTypebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any user. When a victim previews a malicious typebot by clicking "Run", JavaScript executes in their browser and exfiltrates their OpenAI keys, Google Sheets tokens, and SMTP passwords. The `/api/trpc/credentials.getCredentials` endpoint returns plaintext API keys without verifying credential ownership. Version 3.13.2 fixes the issue.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.02% | 0.052 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security-advisories@github.com | 7.4 | 2.8 | 4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
|
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
The product does not encrypt sensitive or critical information before storage or transmission.
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.