Executive brief
Budibase is a low-code platform for building business applications and automations. The authentication session cookie is configured without the httpOnly flag, allowing any JavaScript code running on the page—including code injected via XSS vulnerabilities—to read and steal the session token. An attacker can weaponize this by combining it with known XSS flaws to gain persistent access to victim accounts.
Technical details
The vulnerability exists in packages/backend-core/src/utils/utils.ts where the budibase:auth cookie—containing a signed JWT session token—is set with httpOnly: false. This allows any JavaScript execution context (XSS payload, malicious browser extension, injected script) to read the full session token via document.cookie and exfiltrate it to an attacker-controlled server. The cookie additionally lacks the secure flag (should prevent HTTP transmission) and sameSite attribute (should mitigate cross-site request attacks). When chained with stored XSS vulnerabilities in entity names (GHSA-gp5x-2v54-v2q5), an attacker can create a malicious entity that steals the JWT of any user who views it, granting persistent account access. The configuration is hardcoded across all Budibase deployments. The fix is to set httpOnly: true, secure: true, and sameSite: 'lax' in the cookie configuration. Patch available in version 3.35.10.
Affected products
- Budibase @budibase/backend-core <3.35.10
Timeline
- 2026-04-24: disclosed: GHSA-4f9j-vr4p-642r published
- 2026-04-21: patched: Fixed in version 3.35.10