CVE-2025-64706

Description

Typebot is an open-source chatbot builder. In version 3.9.0 up to but excluding version 3.13.0, an Insecure Direct Object Reference (IDOR) vulnerability exists in the API token management endpoint. An authenticated attacker can delete any user's API token and retrieve its value by simply knowing the target user's ID and token ID, without requiring authorization checks. Version 3.13.0 fixes the issue.

PUBLISHED Reserved 2025-11-10 | Published 2025-11-13 | Updated 2025-11-13 | Assigner GitHub_M

Problem types

CWE-639: Authorization Bypass Through User-Controlled Key

CWE-284: Improper Access Control

Product status

References

github.com/...bot.io/security/advisories/GHSA-grx8-g27p-8hpp

cve.org (CVE-2025-64706)

nvd.nist.gov (CVE-2025-64706)

Download JSON