CVE-2026-62862 baptisteArno CVE debrief

Who should care

Administrators and users of Typebot instances, particularly those using email magic-link authentication, should assess exposure and update to version 3.18.0 or later. Affected operator, platform, vulnerability-management, and security-team impact should be evaluated to ensure proper mitigation and protection.

Why it matters

CVE-2026-62862 is a critical vulnerability in Typebot's email magic-link authentication, allowing for account takeover via login-code brute forcing. Administrators and users of affected instances should assess exposure and update to version 3.18.0 or later.

• An attacker can brute-force the callback and obtain an authenticated session as a victim user with no victim interaction
• An attacker can gain full access to the victim's bots, results, and connected integration credentials
• The vulnerability allows for account takeover via login-code brute forcing

Technical summary

Typebot's email magic-link authentication is vulnerable to login-code brute forcing, allowing account takeover. The vulnerability exists in self-hosted versions up to and including 3.17.1. The default passwordless email magic-link authentication uses a 6-digit code generated using Math.random(), reducing the keyspace to 900,000 with a 10-minute expiry. The verification callback enforces no attempt limit, lockout, or CSRF protection, and an incorrect guess does not consume the real code because the adapter returns null on a not-found token.

Defensive priority

High

Recommended defensive actions

• Review and update Typebot installations to version 3.18.0 or later.
• Assess exposure of Typebot instances using email magic-link authentication.
• Implement additional security measures, such as rate limiting and CSRF protection, for affected instances.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Typebot's email magic-link authentication, which allows for account takeover via login-code brute forcing. The vulnerability exists in self-hosted versions up to and including 3.17.1. The default passwordless email magic-link authentication uses a 6-digit code generated using Math.random(), reducing the keyspace to 900,000 with a 10-minute expiry. The verification callback enforces no attempt limit, lockout, or CSRF protection.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.