CVE-2026-48495

CVE-2026-48495 affects TypeBot prior to v3.17.0: the Google Sheets OAuth callback decodes a base64-encoded JSON state and trusts embedded workspaceId, typebotId, blockId, and redirectUrl without cryptographic integrity or authorization checks. Although the callback route is authenticated, it does...