CVE-2026-39969

TypeBot is a chatbot builder tool. In versions 3.16.0 and prior, the WhatsApp Cloud API webhook endpoint (POST /v1/workspaces/{workspaceId}/whatsapp/{credentialsId}/webhook) does not verify the x-hub-signature-256 HMAC signature included by Meta in every webhook delivery. The webhook URL exposes both workspaceId and credentialsId as path parameters, which are logged in web server access logs, visible in Meta's webhook configuration dashboard, and potentially shared when configuring integrations. This allows any unauthenticated attacker to send spoofed webhook messages to trigger bot flows, consume API resources, and interact with external services using the workspace owner's credentials. The issue has been fixed in version 3.17.0.

• CWE-287
• CWE-345

• https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0
• https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-8vqp-r5w7-v47f
• https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-8vqp-r5w7-v47f

Published

May 22, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39963Serendipity is a PHP-powered weblog engine. In versions 2.6-…6.9
• CVE-2026-39964TypeBot is a chatbot builder tool. In versions prior to 3.16…5.4
• CVE-2026-39965TypeBot is a chatbot builder tool. Versions 3.15.2 and prior…7.7
• CVE-2026-39966TypeBot is a chatbot builder tool. In versions 3.15.2, the g…6.5
• CVE-2026-39967TypeBot is a chatbot builder tool. In versions 3.15.2 and pr…3.1
• CVE-2026-39968TypeBot is a chatbot builder tool. In versions 3.15.2 and pr…7.1
• CVE-2026-3997The Text Toggle plugin for WordPress is vulnerable to Stored…6.4
• CVE-2026-39970TypeBot is a chatbot builder tool. Versions 3.15.2 and prior…8.5
• CVE-2026-39971Serendipity is a PHP-powered weblog engine. In versions 2.6-…7.2
• CVE-2026-39972Mercure is a protocol for pushing data updates to web browse…7.1
• CVE-2026-39973Apktool is a tool for reverse engineering Android APK files.…7.1
• CVE-2026-39974n8n-MCP is a Model Context Protocol (MCP) server that provid…8.5