Advisory · CVE-2026-100684
Budibase SSO invite claim hands attackers admin on a plate
Budibase 3.41.0 before 3.45.0 has an authentication bypass in the OIDC/SSO login path: when no existing user matches the incoming SSO subject, the server looks up pending invites by the IdP-asserted email alone, without validating an invite code or requiring email_verified. An attacker who can register at a trusted IdP and assert a victim's invited email claims the pending invite with all its privileges, including builder and admin.global, for full tenant compromise. Fixed in 3.45.0.
- Vendor
- Budibase
- Product
- Budibase
- Identifier / CWE
- CVE-2026-100684
CWE-287 - Action timing
- Immediate
Explain it like I’m five
The office holds a desk with a new-hire badge for each invited person. The receptionist hands the badge to anyone who says the invitee's email address at the door, without checking the invitation letter or whether the email is verified, even for the master-key badge.
- 01IdP registration
The attacker registers at a trusted identity provider and asserts a victim's invited email.
- 02SSO login
No existing user matches the incoming SSO subject, so the server falls back to the pending-invite lookup.
- 03Email-only match
The invite is found by IdP-asserted email alone, with no invite-code validation and no email_verified requirement.
- 04Privilege claim
The attacker claims the invite with all its privileges, including builder and admin.global: full tenant compromise.
What happened
Budibase 3.41.0 before 3.45.0 has an authentication bypass in the OIDC/SSO login path (CVE-2026-100684, CVSS 9.2). When no existing user matches the incoming SSO subject, the server looks up pending invites by the IdP-asserted email alone, without validating an invite code or requiring email_verified. An attacker who can register at a trusted IdP and assert a victim’s invited email claims the pending invite with all its privileges, including builder and admin.global, achieving full tenant compromise. The issue is fixed in Budibase 3.45.0.
What to do
- Upgrade Budibase to 3.45.0 or later.
- Audit pending invitations and revoke any that are stale or unexpected.
- Review accounts created via SSO for invites claimed by unexpected identities.
- If your IdP allows self-registration, reconsider that trust decision for the Budibase SSO integration.
Management note
This is the third invitation-claim flaw pattern across today’s advisories (Flowise has two siblings), and it is the same lesson each time: an invite is a credential, and matching it by email alone is not verification. Patch, then clear the invite backlog.