Budibase OIDC SSO Flaw Allows Account Takeover

A critical security vulnerability identified as GHSA-hp6v-6jw7-gv2f affects the Budibase server package. The flaw exists within the OpenID Connect (OIDC) single sign-on implementation, which fails to verify the email_verified claim before linking external identity provider accounts to existing internal user profiles.

By design, the Budibase authentication middleware relies on the email address provided by an identity provider to associate users with their accounts. Because the system does not check whether the email has been verified by the identity provider, an attacker can supply an unverified email address that matches an existing victim's account. This allows the attacker to bypass authentication and assume the identity and roles of any user, including global administrators.

What's at Risk

The vulnerability affects users of the @budibase/server package. Any organization deploying Budibase with OIDC SSO enabled is potentially exposed to this risk. The impact is most severe for internet-facing instances where external identity providers are used to manage authentication for sensitive internal applications.

Successful exploitation results in a full account takeover. Because the system automatically merges identities based on the email claim, an attacker gaining control of an account inherits all existing permissions associated with that user. This includes access to administrative functions, data management, and application building capabilities within the Budibase environment.

How the Flaw Works

This vulnerability stems from a failure to adhere to standard identity verification protocols. In general, applications using OIDC for authentication must treat the email claim as untrusted unless the identity provider explicitly asserts that the email has been verified. When a system ignores the email_verified flag, it creates a trust gap that allows an attacker to claim ownership of an account simply by providing a matching email address.

In this class of vulnerability, attackers typically leverage configured identity providers that permit the creation of accounts with unverified email addresses. By manipulating the token claims, they force the application to perform an account merge. This type of logic error is a common pitfall in identity management, often occurring when developers prioritize convenience and seamless account linking over strict security validation requirements.

How to Protect Your Systems

• Monitor Budibase security advisories for the release of a patch addressing the OIDC email verification issue.
• Disable OIDC SSO functionality if it is not strictly required for your current operations until a fix is verified and applied.
• Review audit logs for unusual login activity or unexpected account role changes that may indicate unauthorized access.
• Restrict access to the Budibase administrative dashboard to trusted network segments or through a secure VPN.
• Ensure that your identity provider is configured to strictly enforce email verification for all users before issuing tokens to third-party applications.

The severity of this account takeover vulnerability necessitates immediate vigilance. Until a patch is made available, administrators should assume that any OIDC-linked account is potentially vulnerable to impersonation. Promptly addressing these configuration gaps is essential to maintaining the integrity of your authentication infrastructure and protecting sensitive administrative access.