The vulnerability resides in Budibase’s OIDC Single Sign‑On flow, where the middleware resolves a user’s email address without validating the email_verified attribute or enforcing an email_verified requirement. An attacker who can authenticate with a configured identity provider that claims a victim’s email as unverified can have that new provider identity linked to the victim’s Budibase account through a fallback lookup on the email address. The attacker then gains all roles and privileges the victim originally possessed. The weakness is a classic authentication bypass (CWE‑287).

Budibase low‑code platform, all versions prior to 3.39.30. The issue is mitigated in Budibase’s 3.39.30 release, so any installation running an earlier release is affected.

The CVSS score of 9 indicates a high severity. EPSS score is not available and the vulnerability is not listed in KEV, so the exploitation probability cannot be determined from those data. An attacker needs a misconfigured or malicious IDP that can supply an unverified email address and does not require any local privileges on the Budibase server. The vulnerability is exploitable via the public OIDC endpoint, making remote takeover possible. The OIDC token crafted by the attacker must include the victim’s email and set email_verified to false, after which the platform will accept the token and link the identity to the victim account.