CVE-2026-48495
Received Received - Intake

Google Sheets OAuth State Parameter Manipulation in TypeBot

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description
TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON `state` parameter and trusts the embedded `workspaceId`, `typebotId`, `blockId`, and `redirectUrl` without cryptographic integrity protection or authorization checks. The callback route is authenticated, but it does not verify that the authenticated user has write access to the target workspace or Typebot before creating credentials in the workspace or updating Typebot groups. An authenticated user who can obtain a valid Google OAuth `code` can alter the `state` value to create Google Sheets credentials in another workspace and, if target IDs are known, attach those credentials to a block in another Typebot. Version 3.17.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-48495
EUVD
EUVD-2026-56243

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
baptistearno typebot to 3.17.0 (exc)
baptistearno typebot 3.17.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in TypeBot's Google Sheets integration allows an authenticated attacker to manipulate the OAuth callback process. The system decodes a base64-encoded state parameter containing workspace and typebot IDs without verifying its integrity or checking user authorization. This lets attackers create Google Sheets credentials in unauthorized workspaces and modify arbitrary typebots.

Detection Guidance

Check Typebot versions below 3.17.0 for potential exposure. Review Google Sheets OAuth callback logs for unauthorized workspace or typebot modifications. Inspect base64-encoded state parameters in OAuth flows for suspicious workspaceId, typebotId, or blockId values.

Impact Analysis

An attacker could disrupt your integrations, cause future Google Sheets actions to use their account, or corrupt your typebot configuration. They might attach malicious credentials to your blocks or modify your typebot settings without proper authorization.

Mitigation Strategies

Upgrade Typebot to version 3.17.0 or later immediately. Verify all Google Sheets integrations for unauthorized credentials or modifications. Audit OAuth callback endpoints for proper state validation and authorization checks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48495. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart