CVE-2026-100684: Budibase OIDC/SSO Auth Bypass Vulnerability

CVE-2026-100684 Overview

CVE-2026-100684 is an authentication bypass vulnerability in Budibase versions 3.41.0 through versions before 3.45.0. The flaw resides in the OpenID Connect (OIDC) and Single Sign-On (SSO) login path of @budibase/server. When no existing user matches an incoming SSO subject, the sso.authenticate function matches pending user invites by the identity provider (IdP) asserted email address alone. The server does not validate an invite code and skips the email_verified check for this code path. An attacker who registers at an IdP that the tenant trusts can claim pending invites for arbitrary email addresses, inheriting any granted privileges including builder and admin.global roles.

Critical Impact
Successful exploitation of an admin invite grants full tenant compromise, including access to all apps, datasources with production credentials, and automations.

Affected Products

Budibase @budibase/server version 3.41.0
Budibase @budibase/server versions after 3.41.0 and before 3.45.0
Tenants configured with trusted OIDC/SSO identity providers

Discovery Timeline

2026-09-26 - CVE-2026-100684 published to the National Vulnerability Database (NVD)
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100684

Vulnerability Analysis

The vulnerability [CWE-287: Improper Authentication] breaks the trust boundary between SSO identity assertions and Budibase's invite acceptance workflow. In the normal onboarding flow, a tenant administrator issues an invite to a specific email address, and the invitee completes registration by presenting the invite code. The affected code path collapses this two-factor binding (invite code plus verified email) into a single lookup against the IdP-asserted email claim.

The email_verified claim protects only the existing-account lookup. The invite-matching branch applies no such gate. An attacker who controls, or can register with, any identity provider federated to the tenant can assert email: victim@example.com with email_verified: false and still consume the pending invite. The attacker inherits the invite's granted roles. For admin.global invites this yields complete tenant takeover.

A secondary impact is denial of onboarding: the invite is consumed on acceptance, so the legitimate invitee can no longer complete registration through the intended path.

Root Cause

The root cause is missing authentication binding in sso.authenticate. The invite lookup accepts an IdP-provided email as sole proof of identity, without requiring the invite token issued out-of-band and without requiring the IdP to attest that the email has been verified. Trust is placed in attacker-controllable claims.

Attack Vector

Exploitation requires network access to the Budibase login endpoint and the ability to authenticate against any IdP the tenant trusts for OIDC. The attacker registers an account at that IdP using the victim's invited email address, initiates SSO login against the Budibase tenant, and the server matches the pending invite by email and provisions the attacker's SSO subject with the invite's roles. No invite code, no prior session, and no user interaction from the victim are required.

No public exploit code is listed in the referenced advisories. See the GitHub Security Advisory GHSA-35ch-57g2-3g98 and the VulnCheck Authentication Bypass Advisory for technical details.

Detection Methods for CVE-2026-100684

Indicators of Compromise

SSO logins where the newly provisioned user matches a recently consumed invite email but originates from an unexpected IdP subject identifier.
New builder or admin.global role assignments created through the SSO login path without a corresponding invite-code redemption event.
Invite acceptance events where the asserted email_verified claim is false or missing.
Legitimate invitees reporting that their invite link is invalid or already consumed.

Detection Strategies

Correlate Budibase authentication logs against IdP logs to identify SSO sessions whose email claim matches a pending invite but whose IdP subject is newly registered.
Alert on first-time administrative role grants to accounts created via SSO within minutes of their first authentication.
Monitor for access to sensitive datasources and automations immediately following a new SSO account provisioning event.

Monitoring Recommendations

Forward Budibase server logs and OIDC provider logs into a centralized analytics platform for cross-source correlation.
Baseline normal invite acceptance patterns, including typical time between invite issuance and acceptance, and alert on deviations.
Review audit trails for datasource credential access and automation modifications performed by SSO-provisioned users within 24 hours of first login.

How to Mitigate CVE-2026-100684

Immediate Actions Required

Upgrade @budibase/server to version 3.45.0 or later across all tenants.
Audit all pending invites, especially any carrying builder or admin.global roles, and revoke those that cannot be positively confirmed with the intended recipient.
Review recent SSO-provisioned accounts for unexpected role assignments and remove unauthorized principals.
Rotate credentials for datasources and automations that were accessible to any compromised administrative account.

Patch Information

Budibase has fixed the issue in @budibase/server version 3.45.0. Refer to the GitHub Security Advisory GHSA-35ch-57g2-3g98 for the official remediation notice.

Workarounds

Temporarily disable OIDC/SSO login for tenants with outstanding administrative invites until the upgrade is applied.
Restrict trusted OIDC providers to IdPs that enforce verified-email policies and that do not allow self-service registration of arbitrary email addresses.
Cancel all outstanding invites and re-issue them only after upgrading to the patched version.
Enforce administrator provisioning through a separate, non-SSO path until the fixed version is deployed.

bash

# Upgrade Budibase server to the patched release
npm install @budibase/server@3.45.0

# Or, for Docker deployments, pin the fixed tag and redeploy
docker pull budibase/budibase:3.45.0
docker compose up -d