Budibase SSO authentication bypass creates unauthorized user accounts
Budibase 3.41.0 through 3.44.x contains an SSO auth bypass where an unrecognized OIDC subject triggers account creation rather than login rejection, granting attackers a valid session.
- Vendor
- Budibase
- Product
- Budibase Server (versions 3.41.0 through 3.44.x)
- CVSS
- 8.1
- EPSS (exploit probability)
- 0.4%
- Status
- patched
- Published
Is CVE-2026-100684 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-100684 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.4% (scored October 25, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-100684 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Budibase versions 3.41.0 through 3.44.x contain an authentication bypass in the OIDC and SSO login path. In the sso.authenticate function of @budibase/server, when an incoming SSO subject identifier does not match any existing user record, the platform creates a new user account and issues a valid session instead of rejecting the login. An attacker who controls a compatible external identity provider can register an arbitrary subject value and obtain a Budibase session with no pre-existing account on the instance.
The affected version range is 3.41.0 to 3.44.x. Budibase 3.45.0 corrects the behavior so that an unrecognized SSO subject results in a login failure rather than account creation. Instances that do not use OIDC or external SSO are not affected.
The advisory notes no evidence of active exploitation. This CVE is not listed in the CISA KEV catalog at publication.
Other Budibase CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-100683 Budibase SQL injection in MySQL and MSSQL column-rename DDLwrite-up | [ HIGH ] | 8.0 | 0.3% | — |
| CVE-2026-100682 Budibase arbitrary file write via ZIP symlink in PWA icon uploadwrite-up | [ HIGH ] | 8.8 | 0.7% | — |
