VYPR
← All advisories
Medium severity5.0NVD Advisory· Published Nov 13, 2025· Updated Jun 17, 2026

CVE-2025-64706

CVE-2025-64706

Description

Typebot is an open-source chatbot builder. In version 3.9.0 up to but excluding version 3.13.0, an Insecure Direct Object Reference (IDOR) vulnerability exists in the API token management endpoint. An authenticated attacker can delete any user's API token and retrieve its value by simply knowing the target user's ID and token ID, without requiring authorization checks. Version 3.13.0 fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Typebot/Typebot2 versions
    cpe:2.3:a:typebot:typebot:*:*:*:*:*:-:*:*+ 1 more
    • cpe:2.3:a:typebot:typebot:*:*:*:*:*:-:*:*range: >=3.9.0,<3.13.0
    • (no CPE)range: <3.13.0
  • Baptistearno/Typebot.iov5
    Range: >= 3.9.0, < 3.13.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.