The flaw allows a low-privilege guest member of a TypeBot workspace to cause the server to send the workspace’s stored OpenAI-compatible API key to a URL supplied by an attacker. By quenching the listModels helper with a malicious baseUrl, the server decrypts the credential, constructs an OpenAI client that embeds the secret in both the apiKey field and the api-key header, and forwards the outbound request. This results in direct exfiltration of a secret that should remain confidential. The weakness is a classic information disclosure flaw (CWE‑200).

TypeBot.io TypeBot versions earlier than 3.17.0 are affected. Any workspace with a guest member who can view credentials and invoke helper functions is susceptible. The vulnerability exists regardless of the workspace’s caller, as long as the account is a readable guest. Newer releases (3.17.0 and later) have applied the patch.

The CVSS score of 7.6 indicates high severity and the EPSS score of < 1 % suggests the vulnerability is unlikely to see widespread exploitation at present. The vulnerability is not listed in CISA KEV. An attacker only needs a low‑privilege guest account and the ability to supply a baseUrl, conditions that are easily fulfilled within a compromised or loosely controlled workspace. The absence of a check against outbound URLs makes the vulnerability straightforward to abuse once the conditions are met.