Budibase SSO authentication bypass creates unauthorized user accounts
Budibase 3.41.0 through 3.44.x contains an SSO auth bypass where an unrecognized OIDC subject triggers account creation rather than login rejection, granting attackers a valid session.
- Vendor
- Budibase
- Product
- Budibase Server (versions 3.41.0 through 3.44.x)
- CVSS
- 8.1
- EPSS (exploit probability)
- 0.3%
- Status
- patched
- Published
Budibase versions 3.41.0 through 3.44.x contain an authentication bypass in the OIDC and SSO login path. In the sso.authenticate function of @budibase/server, when an incoming SSO subject identifier does not match any existing user record, the platform creates a new user account and issues a valid session instead of rejecting the login. An attacker who controls a compatible external identity provider can register an arbitrary subject value and obtain a Budibase session with no pre-existing account on the instance.
The affected version range is 3.41.0 to 3.44.x. Budibase 3.45.0 corrects the behavior so that an unrecognized SSO subject results in a login failure rather than account creation. Instances that do not use OIDC or external SSO are not affected.
The advisory notes no evidence of active exploitation. This CVE is not listed in the CISA KEV catalog at publication.
