CVE-2026-39969: TypeBot: WhatsApp Webhook Endpoint Missing Signature Verification
TypeBot is a chatbot builder tool. In versions 3.16.0 and prior, the WhatsApp Cloud API webhook endpoint (POST /v1/workspaces/{workspaceId}/whatsapp/{credentialsId}/webhook) does not verify the x-hub-signature-256 HMAC signature included by Meta in every webhook delivery. The webhook URL exposes both workspaceId and credentialsId as path parameters, which are logged in web server access logs, visible in Meta's webhook configuration dashboard, and potentially shared when configuring integrations. This allows any unauthenticated attacker to send spoofed webhook messages to trigger bot flows, consume API resources, and interact with external services using the workspace owner's credentials. The issue has been fixed in version 3.17.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TypeBot: WhatsApp Cloud API webhook endpoint (POST /v1/workspaces/{workspaceId}/whatsapp/{credentialsId}/webhook)to a version that resolves this vulnerability.Fixed in 3.17.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39969?
The severity of CVE-2026-39969 is rated as medium with a score of 6.5.
How do I fix CVE-2026-39969?
To fix CVE-2026-39969, upgrade to TypeBot version 3.17.0 or later where the webhook endpoint includes HMAC signature verification.
What is the risk associated with CVE-2026-39969?
CVE-2026-39969 has a risk rating of 40, indicating potential vulnerabilities in the associated webhook due to lack of signature verification.
What versions are affected by CVE-2026-39969?
CVE-2026-39969 affects TypeBot versions 3.16.0 and prior.
What vulnerability does CVE-2026-39969 expose?
CVE-2026-39969 exposes the WhatsApp webhook endpoint to potential unauthorized access due to missing signature verification.