High · published January 22, 2026
⚡ Typebot versions prior to 3.13.2 are leaking your secrets! A single click on a malicious chatbot can expose sensitive credentials like OpenAI keys and SMTP passwords. 🔥 Think of it like a sneaky waiter who takes your credit card for a quick payment but instead copies down all your personal information while you're distracted. That's exactly what happens when someone previews a rogue Typebot – your credentials go right out the window! An attacker could effortlessly obtain all stored credentials from any user, potentially leading to unauthorized access to critical accounts and systems. With keys to the kingdom, they could wreak havoc, access sensitive data, and undermine your entire security framework. This isn't just a hiccup; it’s a full-blown data breach waiting to happen!
Think of it like a sneaky waiter who takes your credit card for a quick payment but instead copies down all your personal information while you're distracted. That's exactly what happens when someone previews a rogue Typebot – your credentials go right out the window! This vulnerability allows client-side script execution in Typebot via the `/api/trpc/credentials.getCredentials` endpoint, which exposes plaintext API keys without verifying if the requester is authorized to access them. Essentially, it lets attackers harvest sensitive information by simply having a victim interact with a malicious Typebot.
An attacker could effortlessly obtain all stored credentials from any user, potentially leading to unauthorized access to critical accounts and systems. With keys to the kingdom, they could wreak havoc, access sensitive data, and undermine your entire security framework. This isn't just a hiccup; it’s a full-blown data breach waiting to happen! Immediately upgrade Typebot to version 3.13.2 or later. Next, review and tighten access controls on the `/api/trpc/credentials.getCredentials` endpoint to ensure only authorized users can retrieve credentials. 🛡️ You’ve got this! Follow these steps, and you’ll be back on track, ensuring your credentials are safe and sound! 🚀