CVE-2026-48483: TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server
TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings, but the forwarding code uses the raw ky instance instead of the repository's SSRF-protected safeKy client. A workspace user who can configure WhatsApp settings can therefore make the Typebot server issue HTTP requests to internal services, private-network hosts, localhost, or metadata-style endpoints whenever the public WhatsApp production webhook receives a status payload that should be forwarded. Version 3.17.0 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Typebotto a version that resolves this vulnerability.Fixed in 3.17.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48483?
CVE-2026-48483 has a medium severity rating of 5.4.
How do I fix CVE-2026-48483?
To remediate CVE-2026-48483, upgrade to TypeBot version 3.17.0 or later.
What does CVE-2026-48483 exploit?
CVE-2026-48483 exploits unvalidated user-controlled URLs, allowing for server-side request forgery (SSRF) from the TypeBot server.
What features are affected by CVE-2026-48483?
The WhatsApp status forwarding feature in TypeBot is affected by CVE-2026-48483.
What types of attacks can be performed due to CVE-2026-48483?
Due to CVE-2026-48483, attackers can potentially perform SSRF attacks against the TypeBot server.