CVE-2026-39969General

LOWCVSS 6.5 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

TypeBot is a chatbot builder tool. In versions 3.16.0 and prior, the WhatsApp Cloud API webhook endpoint (POST /v1/workspaces/{workspaceId}/whatsapp/{credentialsId}/webhook) does not verify the x-hub-signature-256 HMAC signature included by Meta in every webhook delivery. The webhook URL exposes both workspaceId and credentialsId as path parameters, which are logged in web server access logs, visible in Meta's webhook configuration dashboard, and potentially shared when configuring integrations. This allows any unauthenticated attacker to send spoofed webhook messages to trigger bot flows, consume API resources, and interact with external services using the workspace owner's credentials. The issue has been fixed in version 3.17.0.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-287CWE-345

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

2 mentions across 1 observed day

What's happening

General: 2 classified signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

General

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Infoflowcloud@infoflowcloud140d
General
🚨*CVE* CVE-2026-39969 TypeBot is a chatbot builder tool. In versions 3.16.0 and prior, the WhatsApp Cloud API webhook endpoint (POST /v1/workspaces/{workspaceId}/whatsapp/{credentialsId}/w… https://www.cve.org/CVERecord?id=CVE-2026-39969 ----- Traducción: CVE-2026-39969 Typ… http://infoflow.cloud`
Post summary
A short tweet lists CVE-2026-39969 for TypeBot with a reference to a vulnerable endpoint, but offers no technical details, PoC, patch, or evidence of exploitation.
0000045
79 followersView on X
CVE@CVEnew140d
General
CVE-2026-39969 TypeBot is a chatbot builder tool. In versions 3.16.0 and prior, the WhatsApp Cloud API webhook endpoint (POST /v1/workspaces/{workspaceId}/whatsapp/{credentialsId}/w… https://www.cve.org/CVERecord?id=CVE-2026-39969
Post summary
A short notice mentions CVE‑2026‑39969 affecting TypeBot’s WhatsApp Cloud API webhook endpoint, but provides no actionable details on exploitation, remediation, or severity.
00000213
57.5K followersView on X

Explore more

Back to dashboard