CVE-2026-42239: Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover
Budibase is an open-source low-code platform. Prior to version 3.35.10, the budibase:auth cookie containing the JWT session token is set with httpOnly: false at packages/backend-core/src/utils/utils.ts:218. JavaScript can read this cookie via document.cookie. This means every XSS becomes a full account takeover — the attacker steals the JWT and has persistent access to the victim's account. The cookie also lacks secure: true (sent over plaintext HTTP) and sameSite attribute. This issue has been patched in version 3.35.10.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42239?
CVE-2026-42239 has a high severity rating due to the potential for unauthorized account takeover through XSS attacks.
How do I fix CVE-2026-42239?
To fix CVE-2026-42239, update Budibase to version 3.35.10 or higher.
What impact does CVE-2026-42239 have on users?
CVE-2026-42239 allows attackers to exploit XSS vulnerabilities to hijack user sessions and take over accounts.
Which versions of Budibase are affected by CVE-2026-42239?
Budibase versions prior to 3.35.10 are affected by CVE-2026-42239.
What specific vulnerability does CVE-2026-42239 address?
CVE-2026-42239 addresses the vulnerability where the budibase:auth cookie is set with httpOnly: false, making it susceptible to theft via XSS.