Budibase CVE-2026-73302
CRITICAL
GHSA-hp6v-6jw7-gv2f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector; AC:H and PR:L because the attacker needs an account on a configured IdP and must control an email claim matching the victim; S:C as the merge crosses into another account's authority, granting full C/I/A over it.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts resolved an email without getEmailVerified or an email_verified requirement, and packages/backend-core/src/middleware/passport/sso/sso.ts then used users.getGlobalUserByEmail as a fallback account-linking key. An attacker who can authenticate through a configured identity provider that asserts a victim email as unverified can have a fresh provider identity merged into the victim Budibase account and inherit the victim roles. This issue is fixed in version 3.39.30.
AnalysisAI
Account takeover in the Budibase low-code platform (prior to 3.39.30) lets an attacker impersonate any existing user by abusing OIDC SSO account-linking. Because the OIDC verify callback in oidc.ts resolved the email claim without ever reading email_verified, and sso.ts fell back to getGlobalUserByEmail as the linking key, a fresh attacker identity from a configured IdP asserting a victim's email - even as unverified - is silently merged into the victim's account, inheriting its _id and roles up to global admin/builder. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Budibase instance is configured to authenticate users via OIDC SSO, and that the attacker can authenticate through one of those configured/trusted identity providers and cause it to emit an ID token whose email claim equals a victim's Budibase email - even with email_verified=false or the flag absent. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely consistent and point to a genuine high priority for organizations running Budibase with OIDC SSO. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a fresh identity at an OIDC identity provider that the target Budibase instance trusts, and configures or manipulates that identity so the token asserts email=admin@victim-org.com with email_verified=false. On login, Budibase fails to match the attacker's new 'sub', falls back to matching by email, and merges the attacker session into the victim's global-admin account. … |
| Remediation | Upgrade to Budibase 3.39.30 or later, which is the vendor-released patch (commit 9ecd0048d9c3ae0ee9bd0e6204c621794dd1a4d3, PR #19173). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, disable OIDC single sign-on functionality across all configured identity providers in Budibase and immediately audit account activity logs for unauthorized administrative or builder actions; within 7 days, upgrade all Budibase instances to version 3.39.30 or later and conduct a forensic review of account access patterns during the vulnerability window to identify compromised accounts; within 30 days, implement mandatory multi-factor authentication for all users and reconfigure OIDC providers to enforce email verification before account linking.
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today