CVE-2026-48495

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON "state" parameter and trusts the embedded "workspaceId", "typebotId", "blockId", and "redirectUrl" without cryptographic integrity protection or authorization checks. The...

CVE-2026-48495: Missing Authorization

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON state parameter and trusts the embedded workspaceId, typebotId, blockId, and redirectUrl without cryptographic integrity protection or authorization checks. The callback rout...