Botpress staff-session impersonation exposed customer AI bot configurations

An attacker exploited a staff SSO/proxy validation weakness to impersonate Botpress personnel and acquire a privileged employee API credential capable of reading or changing customer bot configurations.

Botpress reports configuration reads across 16 workspaces and integration changes in two others during its October investigation. Potentially reachable AI or CRM secrets are not equivalent to confirmed theft of every token or user conversation.

Botpress provides a chronology that distinguishes account access from downstream token abuse. An attacker probed a staff authentication proxy from October 12, used forged staff sessions to explore internal tools, then obtained an employee API credential with customer-workspace administration rights. On October 21 between 07:44 and 08:23 UTC, the attacker read bot configurations in 16 workspaces and changed an integration in two others. Botpress patched the proxy flaw and revoked the credential that afternoon, and said subsequent attempts observed through November 3 were blocked. Bot configurations can include AI-provider and CRM credentials, but logs did not establish which individual secrets were valid or subsequently used. The vendor described unauthorized AI-credit consumption as the suspected economic objective, not proven exfiltration of every customer conversation.

The security consequence follows from the bot configuration being an integration control plane. Impersonating an employee exposed a privileged API credential; reading a customer's bot configuration could in turn reveal how that bot connects to other services, while modifying integrations could alter its future behavior. Botpress reports a defined October 21 window affecting 16 read workspaces and two additional modified workspaces. It does not identify every exposed provider token as stolen or establish access to all end-user conversations. Provider-side token logs and rotation matter even after the staff-session weakness is fixed.