CVE-2026-100684 budibase CVE debrief

Who should care

Budibase Server administrators and users, security teams responsible for monitoring and patching vulnerabilities, developers using Budibase Server for application development, and operators managing Budibase Server deployments. These stakeholders should review and apply the vendor's patch to update to version 3.45.0 or later. They should also implement additional monitoring and authentication checks for OIDC/SSO login paths and verify the integrity of user

Why it matters

The CVE-2026-100684 vulnerability in Budibase Server allows an attacker to bypass authentication and potentially compromise the entire tenant. Budibase Server administrators and users should review and apply the vendor's patch to update to version 3.45.0 or later. Security teams should implement additional monitoring and authentication checks for OIDC/SSO login paths. Developers using Budibase Server should verify the integrity of user invites and ensure email verification is properly enforced.

• Potential full tenant compromise, including access to all apps, datasources, and automations
• Elevation of privileges for an attacker, including builder and admin.global roles
• Denial of onboarding for the legitimate invitee
• Possible data breaches or unauthorized access to sensitive information

Technical summary

The Budibase Server vulnerability allows an attacker to bypass authentication by claiming a pending user invite via OIDC/SSO login. The attacker can assert a victim's invited email address, potentially leading to full tenant compromise. This vulnerability is caused by the lack of validation of invite codes and email verification in the sso.authenticate function. The affected product context requires review and update to prevent unauthorized access. Security teams should implement additional monitoring and authentication checks for OIDC/SSO login paths. Developers using Budibase Server should verify the integrity of user invites and ensure email verification is properly enforced.

Defensive priority

High

Recommended defensive actions

• Review and apply the vendor's patch to update Budibase Server to version 3.45.0 or later
• Implement additional monitoring and authentication checks for OIDC/SSO login paths
• Verify the integrity of user invites and ensure email verification is properly enforced
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the authentication bypass vulnerability in Budibase Server. The vendor has provided an advisory on GitHub, and VulnCheck has published a detailed advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.