CVE-2026-100684 Details
Description
Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing user matches the incoming SSO subject, the server looks up pending user invites by the IdP-asserted email address alone — without validating an invite code and without an email_verified check (the email_verified gate protects only the existing-account lookup). An attacker who can register at an IdP that the tenant trusts for OIDC and assert a victim's invited email address (even with email_verified=false) claims the pending invite and inherits all of its granted privileges, including builder and admin.global, with no admin exclusion. This results in takeover of the invited principal and, for admin invites, full tenant compromise (access to all apps, datasources including production credentials, and automations); the invite is consumed, denying onboarding to the legitimate invitee.
A critical authentication bypass vulnerability has been identified in Budibase versions 3.41.0 prior to 3.45.0, specifically within the OIDC/SSO login process of the @budibase/server package. The issue arises in the 'sso.authenticate' function, where the server links pending user invites to incoming SSO identities based solely on the email address provided by the Identity Provider (IdP). This linkage occurs without verifying an invite code or checking if the email has been verified, leaving a gap that can be exploited. An attacker who registers with a trusted IdP and asserts the email of a victim with a pending invite can claim the invite and gain all associated privileges, including builder and admin rights, leading to a complete takeover of the victim's account. This vulnerability not only allows unauthorized access but also consumes the invite, preventing the legitimate user from onboarding.
Users are advised to update to Budibase version 3.45.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026CISA-ADP
Assessed Sep 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Budibase/budibase/security/advisories/GHSA-35ch-57g2-3g98 | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/Budibase/budibase/security/advisories/GHSA-35ch-57g2-3g98 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/budibase-server-3.41.0-before-3.45.0-authentication-bypass-via-oidc | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Budibase | >= 3.41.0, <= 3.42.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | CVE Modified | [email protected] |
| Sep 28, 2026 | CVE Modified | CISA-ADP |
| Sep 26, 2026 | New CVE Received | [email protected] |