CVE-2026-100684

Name of the Vulnerable Software and Affected Versions Budibase versions 3.41.0 through 3.44.9

Description An authentication bypass exists in the OIDC/SSO login path of @budibase/server. Within the sso.authenticate function, the server fails to validate an invite code or perform an email verified check when looking up pending user invites by the IdP-asserted email address if no existing user matches the SSO subject. An attacker capable of registering at a trusted Identity Provider (IdP) and asserting a victim's invited email address can claim the pending invite. This allows the attacker to inherit all granted privileges, such as builder and admin.global, leading to the takeover of the invited principal and full tenant compromise, including access to all applications, datasources, production credentials, and automations.

Recommendations Update Budibase to version 3.45.0 or later.