Budibase Server prior to 3.45.0 is vulnerable to an authentication bypass that occurs during the OIDC Single Sign‑On (SSO) login path. When a new user attempts to authenticate and no existing account is found that matches the incoming SSO subject, the server looks up pending invites by the IdP‑provided email address without validating an invite code or checking that the email was verified. An attacker who can register at an IdP trusted by the tenant and supply a victim’s invited email address—regardless of the email_verified flag—can claim the pending invitation, inherit all of its granted permissions, and switch into the invited principal’s account. For admins, this provides full tenant compromise, exposing all applications, data sources and automation settings.

The vulnerability affects Budibase Server, versions 3.41.0 up to but not including 3.45.0. Tenants running any of these releases are susceptible if OIDC/SSO authentication is enabled.

The flaw carries a CVSS score of 9.2, indicating a critical risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, but the attack requires only that the victim's email be listed on a pending invite and that the attacker has access to an IdP that the tenant accepts for OIDC. The attack vector is thus a forged OIDC assertion from a trusted IdP, which can be performed remotely by creating a malicious account on that IdP. Once the invite is claimed, the attacker gains whatever privileges were granted to the original invitee, potentially full administrative control over the entire tenant.