CVE-2026-73308: Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders
Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts returned automation test results containing trigger.outputs.user.oauth2, broadcast BuilderSocketEvent.AutomationTestProgress to the app room, and stored progress in packages/server/src/automations/testProgress.ts without user scoping. A co-builder could receive or poll another SSO-authenticated builder test and obtain OAuth2 access and refresh tokens. The fix adds sanitizeAutomationTestResult and isolates progress by user. This issue is fixed in version 3.39.25.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.39.25
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73308?
The severity of CVE-2026-73308 is medium, rated at 5.7.
What type of vulnerability is CVE-2026-73308?
CVE-2026-73308 is categorized as an information leak vulnerability.
How do I fix CVE-2026-73308?
To fix CVE-2026-73308, update Budibase to version 3.39.25 or later where the issue has been addressed.
What can be exposed due to CVE-2026-73308?
CVE-2026-73308 can expose OAuth2 tokens via automation test results, leading to potential unauthorized access.
Which software is affected by CVE-2026-73308?
CVE-2026-73308 affects the Budibase platform prior to version 3.39.25.