A flaw in the Budibase authentication mechanism allows the session cookie, which contains a JWT, to be set with httpOnly disabled, secure omitted, and sameSite missing. Because the cookie is readable by client-side JavaScript, any injected cross‑site scripting code can retrieve the token and gain persistent full access to the victim’s account. The vulnerability presents a direct path for an attacker to hijack accounts without further compromise, impacting confidentiality and integrity of user data.

Budibase, an open‑source low‑code platform, is affected in all releases prior to version 3.35.10. Users must update to 3.35.10 or later to receive the fix that sets httpOnly, secure, and sameSite attributes for the auth cookie.

The CVSS score of 8.1 classifies this issue as high severity. With no EPSS value available and the vulnerability absent from the CISA KEV catalog, official indicators do not quantify current exploitation probability, but the straightforward XSS attack path suggests a realistic risk for environments with web vulnerabilities. Attackers need only inject script to read the cookie, bypassing any authentication, and can then impersonate the user for the entire session duration.