CVE-2026-47702

The CVSS 9.1 rating for CVE-2026-47702 points to a cleartext storage flaw in TypeBot's API tokens, but treating this as merely a storage defect obscures the more serious architectural failure at play. The vulnerability allows stolen tokens to grant impersonation without requiring the user's password or MFA — meaning these tokens function as credential replacements rather than scoped session tokens. That's an authentication model problem, not just a storage bug. If version 3.17.0 only hashes the tokens without changing their role in the authentication flow, the fix addresses the symptom while leaving the underlying defect intact. A hashed credential-equivalent is better than cleartext, but it doesn't change the fact that a stolen token can still impersonate any user without touching their actual credentials. For organizations where password reuse is common, a extracted TypeBot token may function as a password-equivalent across other systems — the blast radius extends well beyond the TypeBot instance itself. The threat-actor profile matters more than the CVSS score suggests. Gaining database read access through SQL injection, backup exposure, or insider access represent fundamentally different attack scenarios with different dwell times and detection profiles. An attacker with SQL injection gets a constrained window; a malicious insider with database access has already crossed a trust boundary that patching alone cannot fix. Practical defense requires more than upgrading to 3.17.0. Treat any token created before the fix as potentially compromised — force rotation across all active sessions. Audit downstream systems where TypeBot tokens serve as trust anchors, as those integrations likely treat the tokens as credential-equivalent. The temporal dimension is critical: backups made during the vulnerable window still contain cleartext tokens that remain valid until explicitly revoked. If your organization maintains long-retention backups, those archives are an attack surface that the patch does not address. Finally, recognize that self-hosted instances often run unmaintained versions indefinitely — abandoned TypeBot installations on older versions represent the persistent sediment layer where this class of vulnerability survives longest.

Reviewed through automated stages and approved by a human before publication.