CVE-2026-100684: Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC
Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing user matches the incoming SSO subject, the server looks up pending user invites by the IdP-asserted email address alone — without validating an invite code and without an emailverified check (the emailverified gate protects only the existing-account lookup). An attacker who can register at an IdP that the tenant trusts for OIDC and assert a victim's invited email address (even with emailverified=false) claims the pending invite and inherits all of its granted privileges, including builder and admin.global, with no admin exclusion. This results in takeover of the invited principal and, for admin invites, full tenant compromise (access to all apps, datasources including production credentials, and automations); the invite is consumed, denying onboarding to the legitimate invitee.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibase Serverto a version that resolves this vulnerability.Fixed in 3.45.0
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Tenants using the affected Budibase Server versions and an OIDC/SSO identity provider that permits an attacker to register an account and assert an invited user's email address are exposed. Pending invitations are the target, including invitations granting builder or admin.global privileges.
What does an attacker need to exploit this issue?
The attacker needs access to an IdP trusted by the tenant for OIDC and must be able to register an IdP account that asserts the email address of a user with a pending Budibase invitation. No existing Budibase account, invite code, or verified email claim is required for the pending-invite path.
What is the likely impact of a successful attack?
The attacker claims the pending invitation and receives its assigned privileges. An admin invitation can result in full tenant compromise, including access to applications, data sources and their production credentials, and automations; the legitimate invitee is also prevented from using the consumed invitation.
How can administrators identify potential exposure or compromise?
Review whether the server version is from 3.41.0 up to but not including 3.45.0, whether OIDC/SSO is enabled, and whether pending invitations exist. Investigate SSO-created accounts associated with invited email addresses, particularly where the IdP assertion had email_verified set to false, and review invitations carrying builder or admin.global permissions.