Authentication Bypass in Budibase Server by Budibase

CVE-2026-100684

What is CVE-2026-100684?

Budibase Server versions prior to 3.45.0 are susceptible to an authentication bypass through the OIDC/SSO login mechanism. The vulnerability arises when the server fails to validate an invite code and does not enforce an email verification check for incoming SSO subjects. Attackers can exploit this gap by registering with a trusted Identity Provider (IdP) and asserting an email address linked to a pending invite, thereby claiming the invite and assuming all associated privileges. This includes potential access for administrators, which can lead to a complete compromise of the tenant's environment, allowing unauthorized access to applications, data sources, and sensitive credentials.

References