External risk intelligence

Typebot Email Login Brute Force Vulnerability Enables Account Takeover.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-62862

Typebot is an open-source chatbot builder, a type of software typically deployed as a web application or customer-facing interface. These platforms are designed to be accessible via the internet to engage with users or collect data, making the login and authentication endpoints naturally reachable from the public internet.

Cross-site Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in self-hosted Typebot versions up to 3.17.1, affecting its default email magic-link authentication. This flaw allows an unauthenticated attacker, knowing a user's email address, to potentially gain account takeover by brute-forcing a verification code. Deployments using only OAuth or SSO are not impacted.

Issue: Login codes can be guessed to take over accounts.
Why remember: It impacts user access to chatbot data.
Executive takeaway: Confirm relevance and review authentication methods.

Attack Path

How an attacker could exploit the issue

An attacker can target self-hosted Typebot instances that use email-based login. By repeatedly guessing a short, time-limited login code sent to a victim's email address, an attacker can bypass authentication and gain full control of the victim's account and its associated data. This attack is possible because the system lacks sufficient protections against brute-force attempts on the login code and uses a predictable code generation method.

Anonymous attacker can reach login endpoint.
Brute-force short, time-limited login code.
Leads to account takeover and data access.

Live Threat

Current exploitation, exposure, and threat context

In self-hosted Typebot instances using default email magic-link authentication, an anonymous attacker could potentially gain unauthorized access to a user's account. This could occur by repeatedly guessing a short, time-limited verification code sent via email, leading to account takeover. Deployments using only OAuth or SSO, without email-based authentication, are not affected.

User accounts and their associated bots.
Brute-forcing a 6-digit code.
Unauthorized access to bot data.

Operational Fix

Recommended remediation, mitigation, and detection steps

For self-hosted Typebot instances using passwordless email magic-link authentication, application owners or platform teams are likely responsible for remediation. The initial step is to identify all deployments, confirm their accessibility and criticality, and then plan remediation based on risk. Deployments using only OAuth or SSO are not affected.

Application owners must own the issue.
Verify email magic-link authentication configurations.
Plan remediation for affected deployments.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Typebot and how is it typically used?

Typebot is an open-source platform that allows users to build conversational chatbots for websites and applications. People use it to create interactive forms, lead generation tools, or support interfaces that collect data and engage visitors directly within a browser or web-based workflow.

Why is CVE-2026-62862 considered a security weakness?

This vulnerability falls under CWE-307 (Improper Restriction of Excessive Authentication Attempts) and CWE-330 (Use of Insufficiently Random Values). In affected versions, the email authentication process uses a predictable 6-digit code instead of a secure token. Because the system lacks lockout mechanisms or rate limiting on the verification step, an attacker can guess the code through brute force to hijack an account.

Do I need to worry if my Typebot instance uses OAuth or SSO?

No, you are not affected. The vulnerability specifically targets the default passwordless email magic-link authentication flow. Deployments configured exclusively to use OAuth or single sign-on (SSO) methods for user access do not use this flawed code-generation path and are not susceptible to this specific brute-force attack.

Is my deployment at risk if it is hosted on the internet?

According to Halo Surface Signal, Typebot instances are often deployed as customer-facing web applications intended for public access. Because the login endpoint is reachable over the internet, an anonymous attacker only needs the victim's email address to attempt this exploit, making internet-facing instances higher-risk targets.

How do I secure my Typebot installation against this?

If you are running a self-hosted version of Typebot, you must upgrade to version 3.18.0 or later to patch the authentication logic. Before upgrading, verify your current configuration to confirm you are using the affected email magic-link method. If upgrading is not immediately possible, consider switching to OAuth or SSO if your environment supports those alternatives.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.