CVE-2026-73302

Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts resolved an email without getEmailVerified or an email_verified requirement, and packages/backend-core/src/middleware/passport/sso/sso.ts then used users.getGlobalUserByEmail as a fallback account-linking key. An attacker who can authenticate through a configured identity provider that asserts a victim email as unverified can have a fresh provider identity merged into the victim Budibase account and inherit the victim roles. This issue is fixed in version 3.39.30.

No package data available.

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

• https://github.com/Budibase/budibase/commit/9ecd0048d9c3ae0ee9bd0e6204c621794dd1a4d3
• https://github.com/Budibase/budibase/pull/19173
• https://github.com/Budibase/budibase/releases/tag/3.39.30
• https://github.com/Budibase/budibase/security/advisories/GHSA-hp6v-6jw7-gv2f