TypeBot allows an authenticated user to add HTTP Request and Code blocks that send data to user‑supplied URLs. The platform validates the initial request to block private IP ranges, but it fails to re‑validate the destination after following a 302 redirect. This defect enables an attacker to instruct the server to transit a redirect to an internal address such as 169.254.169.254, thereby exposing cloud metadata, private subnets, and container‑internal services to the attacker. The vulnerability is a classic instance of CWE‑918 and can be used to exfiltrate IAM credentials or probe protected APIs that are otherwise unreachable from the Internet.

The source publisher, baptisteArno/typebot.io, offers the TypeBot chatbot builder. All versions up to 3.15.2 are impacted; the issue was mitigated beginning with release 3.16.0.

The CVSS score of 7.7 categorises the flaw as high‑severity. While an EPSS score is not available, the lack of a CISA KEV listing suggests no known exploitation at the time of writing, yet the ability to hijack authenticated bot configuration grants an attacker full internal reach. The exploit requires an authenticated user role, making the risk confined to users who have editing rights on a bot. Nevertheless, once exploited, the impact includes credential theft and complete network enumeration.