CVE-2026-73302: Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified
Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts resolved an email without getEmailVerified or an emailverified requirement, and packages/backend-core/src/middleware/passport/sso/sso.ts then used users.getGlobalUserByEmail as a fallback account-linking key. An attacker who can authenticate through a configured identity provider that asserts a victim email as unverified can have a fresh provider identity merged into the victim Budibase account and inherit the victim roles. This issue is fixed in version 3.39.30.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.39.30
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73302?
CVE-2026-73302 has a risk score of 58, indicating a medium level of severity.
What type of vulnerability is CVE-2026-73302?
CVE-2026-73302 is an account takeover vulnerability related to the OIDC SSO flow in Budibase.
How do I fix CVE-2026-73302?
To fix CVE-2026-73302, update Budibase to version 3.39.30 or later.
What specific issue does CVE-2026-73302 address?
CVE-2026-73302 addresses the lack of an email verification check in the OIDC flow that can lead to account takeover.
Which software versions are affected by CVE-2026-73302?
CVE-2026-73302 affects versions of Budibase prior to 3.39.30.