A critical authentication bypass in the Budibase low-code platform allows unauthenticated remote attackers to hijack pending administrative invitations. By exploiting flaws in the OIDC/SSO login flow, an attacker can claim an invite intended for another user, inheriting the privileges associated with that invitation, including global administrator access.
The vulnerability, tracked as CVE-2026-100684, carries a CVSS v4.0 score of 9.2. The vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) confirms low attack complexity. The AT:P component denotes environmental prerequisites rather than technical barriers: the target environment must have OIDC/SSO enabled and at least one pending user invitation must exist. The flaw affects Budibase Server versions 3.41.0 through 3.44.x, with a fix implemented in version 3.45.0.
The root cause resides in the sso.authenticate function. When the system processes an OIDC login attempt and finds no existing local user matching the incoming subject, it initiates a fallback mechanism. This logic searches for pending user invitations based solely on the email address asserted by the Identity Provider (IdP). Crucially, this path lacks validation for an invite code and fails to verify the email address. While an email_verified check exists in the platform, it only protects the lookup for existing accounts, leaving the invite-claim path exposed.
Successful exploitation results in full tenant compromise. An attacker who controls an account at a trusted IdP can assert the email address of a victim who has been sent an invite. By doing so, the attacker claims the invite, consumes it — denying the legitimate user access — and inherits all associated privileges. This includes builder and admin.global roles, granting the attacker access to all applications, production-grade datasources, and automations.
As of late September 2026, there are no confirmed reports of exploitation in the wild, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, one public proof-of-concept repository has been reported by SOCRadar. Organizations should prioritize upgrading to version 3.45.0 or higher. If immediate patching is not feasible, administrators should disable OIDC/SSO, audit all pending invites, review accounts created during the affected window, and verify current global admin and builder role assignments.
This incident marks the fourth time this desk has documented the trust-through-defaults pattern, where federation layers implicitly trust IdP assertions without binding them to the intended local context. The structural failure mirrors the Keycloak masked-secret reuse (Post 131948, CVE-2026-15943), the Better Auth OAuth state reuse (Post 132071, CVE-2026-110862), and the Frontegg SAML SSO WordPress plugin issue (Post 132087, CVE-2026-75800). In each case, the platform trusted the identity provider’s assertion as sufficient proof without binding it to the specific local action — a user account, a payment credential, a WordPress admin role, and now a pending invite.
For low-code platforms shipping enterprise SSO, the pattern carries a structural warning. OIDC and SAML federation layers that accept IdP assertions without independently validating the local binding — who the invite was for, whether the email was verified, whether an invite code was required — expose the tenant to takeover through any IdP the attacker can register with. The fix in Budibase 3.45.0 adds invite-code validation to the fallback path. The broader requirement is that every federation-to-local binding must be validated at the point of privilege assignment, not assumed from the IdP’s assertion alone.
