Budibase OIDC SSO account takeover via unverified email linking

Executive brief

Budibase is a low-code platform used to build business applications. A security flaw in its login system allows an attacker to take over any user account, including administrator accounts, by using a specially crafted login through a trusted identity provider (like Keycloak or Authentik). This could lead to a total compromise of the platform, including access to sensitive business data, applications, and stored credentials.

Technical details

Budibase's OIDC SSO implementation fails to verify the 'email_verified' claim in ID tokens. When a user authenticates via OIDC, Budibase attempts to match the 'sub' claim; if no match is found, it falls back to matching the 'email' claim. Because it does not check if the email has been verified by the Identity Provider (IdP), an attacker can register an account on a trusted IdP using a victim's email address (without needing access to that email) and successfully log into the victim's Budibase account. This results in a full account takeover, inheriting all roles and permissions of the victim. The vulnerability is present in the OIDC verification callback within 'packages/backend-core/src/middleware/passport/sso/oidc.ts'.

Affected products

• Budibase Budibase <= 3.38.1

Timeline

• 2026-07-22: advisory: Initial GitHub Advisory published
• 2026-07-24: disclosed: Advisory updated with full details

References

• https://api.github.com/users/freeman-bb
• https://github.com/freeman-bb
• https://api.github.com/users/freeman-bb/gists%7B/gist_id%7D
• https://api.github.com/users/freeman-bb/repos
• https://avatars.githubusercontent.com/u/234043877?v=4
• https://api.github.com/users/freeman-bb/events%7B/privacy%7D