CVE-2026-113459: TYPO3 OpenAI plugin: API key exposed to backend users

AWAITING NVD

Published October 20, 2026

CISO Take

A TYPO3 editor extension that integrates OpenAI (affecting TYPO3 10 and 11 installs) embeds the configured OpenAI API key in every backend page so the browser can call OpenAI directly, which means any authenticated backend user, including low-privilege editors, can read the key from the page source. Exploitation is trivial for an insider or an attacker holding a single compromised editor account, but the impact is limited to financial abuse of the key and consumption of the operator's quota. It only applies when a key has been configured. EPSS is low at 0.38% (top 69%), there is no public exploit, the CVE is not in CISA KEV and no CVSS score has been assigned. Apply the fix described in TYPO3 advisory typo3-ext-sa-2026-035, rotate any OpenAI key that was ever configured in the extension, and set spending limits and usage alerts on the OpenAI account.

Sources:NVDEPSStypo3.orgATLAS

What is the risk?

Low-to-medium risk. Exploitation needs only a valid backend login and no technical skill, since the key is exposed in the page output. The consequence is theft of the API credential, which leads to unauthorized spend, quota exhaustion and possible access to any OpenAI-account features the key allows. There is no direct code execution or data compromise on the TYPO3 host. TYPO3 10 and 11 are end-of-life, which increases the chance that affected sites stay unpatched. Exposure is limited to organizations that configured a key in the extension.

How does the attack unfold?

Initial Access

Attacker logs in to the TYPO3 backend with a low-privilege or compromised editor account.

AML.T0012

Credential Discovery

Attacker reads the OpenAI API key embedded in the backend page source or in network responses.

AML.T0055

Impact

Attacker uses the stolen key from external infrastructure, consuming the operator's OpenAI quota and budget.

AML.T0034

Initial Access

Attacker logs in to the TYPO3 backend with a low-privilege or compromised editor account.

AML.T0012

Credential Discovery

Attacker reads the OpenAI API key embedded in the backend page source or in network responses.

AML.T0055

Impact

Attacker uses the stolen key from external infrastructure, consuming the operator's OpenAI quota and budget.

AML.T0034

How severe is it?

CVSS 3.1

N/A

EPSS

0.4%

chance of exploitation in 30 days

Higher than 29% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Upgrade the extension to the fixed version listed in TYPO3 advisory typo3-ext-sa-2026-035, or move to a design where OpenAI calls are proxied server-side so the key never reaches the browser. 2) Immediately revoke and rotate the OpenAI API key, and treat the old key as compromised. 3) Use a dedicated, project-scoped key with a hard monthly spend cap and rate limits. 4) Review OpenAI usage logs for unexpected IPs, models or volume spikes. 5) Audit backend user accounts, remove unused editors and enforce MFA. 6) Plan migration off TYPO3 10 and 11, which are out of standard support.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageData ExtractionPluginAPIAML.T0012- Valid Accounts AML.T0034- Cost Harvesting AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Mechanisms to respond to and recover from unknown risks

OWASP LLM Top 10

LLM02-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-113459?

Is CVE-2026-113459 actively exploited?

No confirmed active exploitation of CVE-2026-113459 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-113459?

1) Upgrade the extension to the fixed version listed in TYPO3 advisory typo3-ext-sa-2026-035, or move to a design where OpenAI calls are proxied server-side so the key never reaches the browser. 2) Immediately revoke and rotate the OpenAI API key, and treat the old key as compromised. 3) Use a dedicated, project-scoped key with a hard monthly spend cap and rate limits. 4) Review OpenAI usage logs for unexpected IPs, models or volume spikes. 5) Audit backend user accounts, remove unused editors and enforce MFA. 6) Plan migration off TYPO3 10 and 11, which are out of standard support.

What systems are affected by CVE-2026-113459?

This vulnerability affects the following AI/ML architecture patterns: CMS-integrated LLM plugins, Browser-side LLM API calls, Third-party LLM API integrations.

What is the CVSS score for CVE-2026-113459?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

CMS-integrated LLM pluginsBrowser-side LLM API callsThird-party LLM API integrations

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0034Cost Harvesting

AML.T0055Unsecured Credentials

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.

Exploitation Scenario

An attacker obtains credentials for a low-privilege TYPO3 backend editor account through phishing or credential reuse. After logging in, they view the page source or the browser network inspector and find the OpenAI API key embedded in the backend page. They copy it and use it from their own infrastructure to run large volumes of LLM requests, or resell access, causing financial loss and quota exhaustion for the site operator. Because the key remains valid until rotated, access persists even after the editor account is disabled.

Weaknesses (CWE)

CWE-201Insertion of Sensitive Information Into Sent Data CWE-201Insertion of Sensitive Information Into Sent Data

CWE-201 — Insertion of Sensitive Information Into Sent Data: The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

[Requirements] Specify which data in the software should be regarded as sensitive. Consider which types of users should have access to which types of data.
[Implementation] Ensure that any possibly sensitive data specified in the requirements is verified with designers to ensure that it is either a calculated risk or mitigated elsewhere. Any information that is not necessary to the functionality should be removed in order to lower both the overhead and the possibility of security sensitive data being sent.

Source: MITRE CWE corpus.