{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/budibase--3.38.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Budibase \u003c= 3.38.1"],"_cs_severities":["critical"],"_cs_tags":["oidc","sso","account-takeover","budibase","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Budibase"],"content_html":"\u003cp\u003eBudibase versions 3.38.1 and earlier are vulnerable to a critical OpenID Connect (OIDC) Single Sign-On (SSO) account takeover. The flaw stems from Budibase's logic for linking OIDC identities to existing Budibase accounts: it uses the \u003ccode\u003eemail\u003c/code\u003e claim from the OIDC ID token as the primary identifier for account merging without verifying the \u003ccode\u003eemail_verified\u003c/code\u003e claim. This means an attacker can manipulate a trusted Identity Provider (IdP) to issue an OIDC token containing a victim's email address with \u003ccode\u003eemail_verified\u003c/code\u003e set to \u003ccode\u003efalse\u003c/code\u003e. When this token is presented to Budibase, the system incorrectly merges the attacker's IdP principal with the victim's existing Budibase account, granting the attacker full access and inheriting the victim's roles, including global administrator privileges. This vulnerability is particularly potent because many IdPs, such as Keycloak and Authentik, have \u0026quot;Verify Email\u0026quot; disabled by default, or allow self-service profile editing without re-verification, making it straightforward for an attacker to craft the necessary unverified email claim.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains control over a configured/trusted Identity Provider (IdP) or identifies a permissive IdP that allows asserting unverified email claims.\u003c/li\u003e\n\u003cli\u003eThe attacker creates an account on the IdP or modifies an existing one to claim the victim's email address, ensuring the \u003ccode\u003eemail_verified\u003c/code\u003e flag for this claim is \u003ccode\u003efalse\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker authenticates with the controlled/manipulated IdP and obtains an OIDC ID token.\u003c/li\u003e\n\u003cli\u003eThe OIDC ID token contains the victim's email (\u003ccode\u003eemail = \u0026lt;victim@domain.com\u0026gt;\u003c/code\u003e) and indicates that this email is \u003ccode\u003eemail_verified = false\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker initiates a standard OIDC SSO login flow to the vulnerable Budibase instance, submitting the crafted OIDC token.\u003c/li\u003e\n\u003cli\u003eBudibase's OIDC verification callback processes the token. It first attempts to match the IdP \u003ccode\u003esub\u003c/code\u003e claim to an existing Budibase user (which fails for a fresh attacker IdP account).\u003c/li\u003e\n\u003cli\u003eBudibase then falls back to matching an existing user by the \u003ccode\u003eemail\u003c/code\u003e claim. It finds the victim's account based solely on the \u003ccode\u003evictim@domain.com\u003c/code\u003e email without checking the \u003ccode\u003eemail_verified\u003c/code\u003e status.\u003c/li\u003e\n\u003cli\u003eBudibase merges the attacker's IdP principal with the victim's existing Budibase account, issuing a session JSON Web Token (JWT) to the attacker for the victim's user ID and inheriting all the victim's roles and permissions, including global admin.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability leads to full account takeover of any existing Budibase user, including global administrators and the instance owner. This grants the attacker complete control over the Budibase tenant, encompassing applications, datasources, automations, user management, and access to stored datasource credentials. Organizations utilizing Budibase for their low-code applications are at risk if they have OIDC SSO configured with an IdP that can issue unverified email claims, regardless of the IdP's strictness in other areas. The immediate consequence is unauthorized access to sensitive data and critical business processes managed within Budibase.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Budibase to a patched version immediately to resolve the vulnerability identified in Budibase \u0026lt;= 3.38.1.\u003c/li\u003e\n\u003cli\u003eConfigure Budibase to explicitly require \u003ccode\u003eemail_verified\u003c/code\u003e to be \u003ccode\u003etrue\u003c/code\u003e before using the \u003ccode\u003eemail\u003c/code\u003e claim for account linking in OIDC SSO, as detailed in the \u003ccode\u003eoidc.ts\u003c/code\u003e and \u003ccode\u003esso.ts\u003c/code\u003e files described in the advisory.\u003c/li\u003e\n\u003cli\u003eAudit all SSO authentication strategies within Budibase, including OIDC, SAML, and social providers, to ensure that email-based account linking always enforces \u003ccode\u003eemail_verified\u003c/code\u003e or similar verification mechanisms.\u003c/li\u003e\n\u003cli\u003eIf immediate patching of Budibase is not possible, enable \u0026quot;Verify Email\u0026quot; or similar email verification mechanisms on your Identity Provider (IdP) and restrict which email domains the IdP will assert.\u003c/li\u003e\n\u003cli\u003eWhere possible, prefer \u003ccode\u003esub\u003c/code\u003e-based account mapping over email-based mapping in your IdP and Budibase configuration.\u003c/li\u003e\n\u003cli\u003eAudit existing Budibase accounts for any unexpected OIDC links, especially for privileged users, and rotate affected user sessions immediately.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T21:18:43Z","date_published":"2026-07-24T21:18:43Z","id":"https://feed.craftedsignal.io/briefs/2026-07-budibase-oidc-sso-account-takeover/","summary":"A critical vulnerability in Budibase versions up to 3.38.1 allows full account takeover of any existing user, including global administrators, by exploiting a flaw in its OIDC SSO implementation that links incoming identities by email address alone without validating the `email_verified` claim, enabling an attacker to log in as a victim if they can coerce a trusted Identity Provider to assert the victim's email as unverified.","title":"Budibase OIDC SSO Account Takeover via Unverified Email Claim","url":"https://feed.craftedsignal.io/briefs/2026-07-budibase-oidc-sso-account-takeover/"}],"language":"en","title":"CraftedSignal Threat Feed - Budibase \u003c= 3.38.1","version":"https://jsonfeed.org/version/1.1"}