Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @budibase/server | npm | <= 3.38.1 |
Miggo AIRoot Cause AnalysisThe vulnerability is an account takeover flaw in Budibase's OIDC SSO implementation. The root cause is that the application linked incoming SSO identities to existing Budibase user accounts based solely on email address, without validating the email_verified claim from the OIDC identity provider (IdP). An attacker could exploit this by using a trusted IdP that allows setting an unverified email address. By setting their email to that of a victim in Budibase, the attacker's SSO session would be incorrectly linked to the victim's account, granting them the victim's roles and permissions.
The analysis of the patch commit 9ecd0048d9c3ae0ee9bd0e6204c621794dd1a4d3 confirms this. The core of the vulnerability lies in the authenticate function in sso.ts, which, prior to the patch, would unconditionally fall back to searching for a user by email. The patch corrects this by adding a condition to check if the email has been verified (details.emailVerified). This status is provided by upstream functions buildVerifyFn and buildJwtClaims in oidc.ts, which were modified to correctly extract the email_verified claim from the OIDC token. The identified functions are all part of this vulnerable data flow, from extracting the unverified email to insecurely using it for account linking.
authenticatepackages/backend-core/src/middleware/passport/sso/sso.ts
buildVerifyFnpackages/backend-core/src/middleware/passport/sso/oidc.ts
buildJwtClaimspackages/backend-core/src/middleware/passport/sso/oidc.ts
getEmailpackages/backend-core/src/middleware/passport/sso/oidc.ts