Executive brief
Budibase is a low-code platform for building web applications. The login system leaks whether an email address is registered by returning different lockout responses for valid versus non-existent accounts after multiple failed login attempts. An attacker can rapidly enumerate valid user accounts and lock them out for 15 minutes, enabling targeted phishing or credential stuffing attacks.
Technical details
This is an account enumeration vulnerability caused by inconsistent lockout behavior in the login middleware and authentication handler. When an existing user fails login 5 times, the server returns a 403 with X-Account-Locked: 1 and Retry-After headers plus "Account temporarily locked" message; for non-existent users, all responses are generic 403 "Unauthorized" because the failure counter is never incremented. The root cause is that lockout tracking is conditioned on user existence (dbUser check in packages/worker/src/middleware/lockout.ts and packages/worker/src/api/controllers/global/auth.ts), creating an observable timing/response discrepancy. The login endpoint has no IP-based rate limiting, allowing rapid enumeration from a single source (~5 requests per email). Attack requires only network access to the login endpoint and no authentication; each successful enumeration also triggers a 15-minute account lockout as a denial-of-service side effect. A patch is available in version 3.40.0 or later.
Affected products
- Budibase Budibase <3.40.0
Timeline
- 2026-07-24: disclosed
- 2026-07-22: patched: Version 3.40.0