Budibase releases earlier than 3.39.0 contain a flaw where the OAuth2 SDK’s fetchToken function posts to a user‑supplied URL without validating its scheme or host. This bypasses the common blacklist check, enabling an attacker to supply internal or cloud‑metadata URLs and retrieve data from private networks or service metadata endpoints, effectively exposing credentials or sensitive configuration information.

All Budibase installations running any version prior to 3.39.0 are affected. The issue resides in the core OAuth2 token handling code and applies regardless of deployment platform or custom configuration.

The CVSS base score of 8.5 indicates high severity, though no EPSS data or publicly reported exploits currently exist, and the vulnerability is not listed in the CISA KEV catalog. An attacker can remotely supply a malicious OAuth2 token endpoint URL, causing the application to make an outbound request to an arbitrary internal host or cloud metadata service, potentially leaking internal resources. Upgrading to 3.39.0 or later removes the flaw by restoring proper blacklist validation.