The vulnerability is tied to the passwordless email authentication in self‑hosted TypeBot versions through 3.17.1. The email provider replaces NextAuth’s cryptographic token with a simple 6‑digit number generated by Math.random(), which reduces the keyspace to 900,000 and sets a 10‑minute expiration. No attempt limit, lockout, CSRF protection, or code consumption on incorrect guesses allows unlimited brute‑forcing. The attacker only needs the target email and can obtain a valid authenticated session by guessing the correct code. This leads to full access to bots, results, and connected integrations for the compromised account.

The affected product is the open‑source TypeBot chatbot builder, specifically self‑hosted deployments up to and including version 3.17.1. Any instance using passwordless magic‑link authentication with an overridden token is vulnerable; configurations that rely exclusively on OAuth or SSO are unaffected.

The CVSS score of 9.1 indicates high severity. The EPSS score is unavailable, so the exact probability of widespread exploitation cannot be quantified here. The vulnerability is not listed in the CISA Knowledge Exploited Vulnerabilities catalog. The attack vector is remote and requires only the victim’s email address. Because the code sending endpoint is limited only by an IP address supplied via X‑Forwarded‑For, an attacker can generate many active codes for the victim in parallel, dramatically increasing the chance of a successful guess. An attacker gains full account privileges without any victim interaction.