Executive brief
Budibase is a low-code platform used to build business applications. An attacker can exploit an unprotected webhook endpoint to inject a malicious URL that intercepts live Microsoft OAuth tokens sent by the application, gaining unauthorized access to the victim's Microsoft 365 environment and internal network resources. No authentication or user interaction is required, and the vulnerability persists after a single attack, affecting all subsequent bot communications.
Technical details
An unauthenticated endpoint in Budibase's AI Agents Microsoft Teams integration (POST /api/webhooks/ms-teams/:instance/:agentId) accepts forged Bot Framework activities without JWT/signature validation and persistently stores attacker-controlled serviceUrl values. The application then uses this poisoned URL as the base for all subsequent bot replies, sending each request with a Bearer token containing a live Microsoft OAuth access_token, effectively exfiltrating credentials to the attacker's host. Additionally, the code path bypasses Budibase's SSRF protections (fetchWithBlacklist and IP pinning), enabling blind internal network access via up to 20 HTTP redirects.
Affected products
- Budibase Budibase before 3.45.0
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: version 3.45.0