External risk intelligence

Budibase OIDC Account Linking Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-73302

Budibase is a low-code platform commonly deployed as a web-based application to enable organizational workflows and business processes. Such applications are frequently exposed to the internet or wide internal networks to allow remote access for users and integration with identity providers, placing the authentication and SSO middleware directly within the reachable web surface.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Budibase low-code platform could allow an attacker to gain unauthorized access to another user's account by impersonating them through a misconfigured identity provider. This could lead to the attacker inheriting the victim's roles and permissions within the Budibase environment.

Unverified emails allow account takeover.
Impacts user roles and system access.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can leverage a misconfigured identity provider to gain unauthorized access to a Budibase account. If the identity provider asserts an email address as unverified, an attacker can use this to merge their own provider identity with a victim's existing Budibase account. This allows the attacker to assume the victim's roles and permissions within the platform, potentially leading to a critical security compromise.

Requires authenticated identity provider access.
Triggers by using an unverified email assertion.
Risk: Inherit victim roles and permissions.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an attacker could merge a fresh identity provider identity into a victim's Budibase account by leveraging an unverified email assertion during the OIDC flow. This could result in the attacker inheriting the victim's assigned roles.

Victim roles could be inherited.
Attacker asserts victim's unverified email.
Unauthorized access to sensitive data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Platform and application owners are likely responsible for addressing this critical vulnerability in the Budibase low-code platform. The first practical step is to identify all Budibase instances, determine their exposure and business criticality, and then confirm the accountable owner for each instance to plan remediation.

Platform and application owners should act.
Verify affected Budibase instances and exposure.
Plan coordinated remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Budibase?

Budibase is an open-source, low-code platform that organizations use to build custom internal business applications and workflows. It simplifies the development process by integrating data sources and managing user authentication through providers, serving as the central engine for executing specialized business logic and managing administrative tasks.

How does CVE-2026-73302 allow unauthorized account access?

This vulnerability involves Improper Authentication (CWE-287). The platform failed to verify the email status during the OIDC login process. Consequently, the system incorrectly linked external identities to existing accounts if they shared the same email address, even if the provider explicitly marked the email as unverified. This allowed an attacker to merge their identity with a victim's account and inherit their permissions.

Do I need a misconfigured identity provider to trigger this?

Yes. An attacker must be able to authenticate through a configured identity provider that allows the assertion of an unverified email address. Simply using a correctly configured provider that enforces strict email verification requirements prevents this specific account-merging logic from executing.

Why is this Budibase vulnerability considered high risk?

Halo Surface Signal indicates that Budibase is frequently deployed as a web-based application accessible over the internet or wide internal networks to support remote business processes. Because the vulnerable SSO middleware sits directly on this reachable surface, the potential for unauthorized account takeover and privilege escalation is significant.

When should I update my Budibase instance?

You should update to version 3.39.30 or later immediately. As a first step, identify all running instances of Budibase within your environment to assess their criticality. Once located, coordinate with the responsible application owners to verify the software version and apply the update to close the authentication gap.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.