The vulnerability in Budibase allows an attacker to send a crafted POST request to the Microsoft Teams webhook endpoint by forging Bot Framework activities with arbitrary serviceUrl values. The server accepts and persists the supplied URL, using it for all subsequent bot replies. This causes the server to transmit Microsoft OAuth access tokens in Authorization headers to the attacker’s host, effectively exfiltrating credentials and enabling blind internal network access. The flaw corresponds to a Server‑Side Request Forgery weakness (CWE‑918).

Budibase server instances using versions prior to 3.45.0 are affected, regardless of installation type. The vulnerability resides in the server component (budibase:server) that handles Teams webhook integration.

The CVSS score of 6.3 indicates a moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widely known active exploits. However, because the flaw is unauthenticated and relies on outbound requests generated by the server, any environment that exposes the Teams webhook endpoint to an attacker’s network can suffer credential theft and subsequent internal network exposure. The risk is heightened for deployments that integrate Microsoft Teams without additional access controls or network segmentation.