Executive brief
Budibase, an open-source low-code platform, contained a flaw in its password reset system that lacked rate limiting and bot protection. An unauthenticated attacker could exploit this to send hundreds of automated emails to a single user or multiple users simultaneously. This can lead to email inbox flooding (denial of service), user harassment, and increased operational costs for the service provider.
Technical details
A business logic vulnerability exists in Budibase's 'Forgot Password' endpoint (PUT /api/v2/auth/password) due to the absence of rate limiting, CAPTCHA, or cooldown mechanisms. An unauthenticated attacker can use automated tools to repeatedly trigger password reset requests for any email address. This results in the exhaustion of transactional email resources (such as Amazon SES) and potential reputation damage to the sender's domain. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The issue has been addressed in version 3.23.25 by implementing rate limiting and lockouts in the authentication flow.
Affected products
- Budibase Budibase < 3.23.25
Timeline
- 2025-11-19: patched: Fix committed to repository
- 2026-04-02: advisory: Vendor advisory published on GitHub
- 2026-04-03: disclosed: CVE published to NVD