CVE-2026-73302 Budibase CVE debrief

Who should care

Budibase administrators and users who utilize OIDC for authentication should assess exposure and prioritize upgrading to version 3.39.30 or later. Defenders should verify Budibase deployments using OIDC for authentication and prioritize upgrading to version 3.39.30 or later. Budibase users and administrators should review and update identity provider configurations to prevent unauthorized access to Budibase accounts.

Why it matters

CVE-2026-73302 Budibase OIDC flow vulnerability allows account merging and role inheritance, requiring defenders to verify deployments and upgrade to version 3.39.30 or later.

• Account merging and role inheritance vulnerability
• Potential for unauthorized access to Budibase accounts
• Need for verification of Budibase deployments using OIDC
• Priority for upgrading to version 3.39.30 or later

Technical summary

The Budibase OIDC flow vulnerability allows an attacker to merge a fresh provider identity into a victim's Budibase account and inherit their roles. This issue is fixed in version 3.39.30. The vulnerability enables unauthorized access to Budibase accounts and requires verification of Budibase deployments using OIDC for authentication. Defenders should prioritize verifying Budibase deployments using OIDC and upgrading to version 3.39.30 or later. The CVE record and NVD entry provide details on the Budibase OIDC flow vulnerability.

Defensive priority

Defenders should prioritize verifying Budibase deployments using OIDC for authentication and upgrading to version 3.39.30 or later.

Recommended defensive actions

• Verify Budibase deployments using OIDC for authentication
• Upgrade to version 3.39.30 or later
• Review and update identity provider configurations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the Budibase OIDC flow vulnerability. The issue is fixed in version 3.39.30. The vulnerability allows an attacker to merge a fresh provider identity into a victim's Budibase account and inherit their roles. Defenders should verify Budibase deployments using OIDC for authentication and prioritize upgrading to version 3.39.30 or later. The CVE record was published on 2026-08-13T22:17:25.353Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.