Vulnerability · Published Nov 13, 2025 · Assigned by GitHub_M

CVE-2025-64706Typebot IDOR Vulnerability: Unauthorized API Token Deletion and Exposure

Medium 5.0

In plain English

A medium-severity authorization bypass via user-controlled key in typebot.io from baptisteArno. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.2%top 83.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Typebot is an open-source chatbot builder. In version 3.9.0 up to but excluding version 3.13.0, an Insecure Direct Object Reference (IDOR) vulnerability exists in the API token management endpoint. An authenticated attacker can delete any user's API token and retrieve its value by simply knowing the target user's ID and token ID, without requiring authorization checks. Version 3.13.0 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
baptisteArno	typebot.io	>= 3.9.0, < 3.13.0

Weakness: CWE-639, CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

References

https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-grx8-g27p-8hpp x_refsource_CONFIRM