8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42239

CVE-2026-42239: Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover

Budibase is an open-source low-code platform. Prior to version 3.35.10, the budibase:auth cookie containing the JWT session token is set with httpOnly: false at packages/backend-core/src/utils/utils.ts:218. JavaScript can read this cookie via document.cookie. This means every XSS becomes a full account takeover — the attacker steals the JWT and has persistent access to the victim's account. The cookie also lacks secure: true (sent over plaintext HTTP) and sameSite attribute. This issue has been patched in version 3.35.10.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42239

CVE-2026-42239:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@budibase/backend-core	npm	< 3.35.10	3.35.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described in GHSA-4f9j-vr4p-642r, is due to insecure settings on the budibase:auth session cookie. Specifically, the cookie was set with httpOnly: false and lacked a secure flag. This makes it possible for an XSS attack to steal the session cookie, leading to account takeover.

The analysis of the provided information points to the setCookie function in packages/backend-core/src/utils/utils.ts as the source of the vulnerability. This function is responsible for setting cookies, and the vulnerability description explicitly mentions the file where it resides.

The investigation of the associated pull request (#18571) and its commits confirms this. Commit 69f3f9dc84d27a47e8f1c52aea213cef2ea3f20d directly modifies the setCookie function to add the secure flag. This change, made to address the GHSA, is direct evidence that setCookie is the function where the insecure cookie attributes were being set. Although the httpOnly flag was the primary concern, the patch for the secure flag within the same function confirms its role in the vulnerability.

Vulnerable functions

setCookie

packages/backend-core/src/utils/utils.ts

The vulnerability lies in the `setCookie` function, which is responsible for setting authentication cookies. According to the vulnerability report, this function was setting the `budibase:auth` cookie with `httpOnly: false` and without the `secure` flag. This would allow an attacker with an XSS vector to steal the cookie and take over a user's account. The provided patch from commit `69f3f9dc84d27a47e8f1c52aea213cef2ea3f20d` modifies this function to add the `secure: ctx.secure` setting. While this only addresses part of the reported vulnerability, it confirms that `setCookie` is the function where the insecure cookie is being set.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.