Budibase, an open‑source low‑code platform, contained a flaw that allowed a co‑builder to receive another builder’s OAuth2 access and refresh tokens via automation test results. The flaw stems from the platform broadcasting the test progress event to an application room without scoping the data to the user who initiated the test. The result is that any user sharing the builder environment can obtain and reuse another user’s SSO credentials, potentially granting unintended access to protected resources.

Users running Budibase versions prior to 3.39.25 are affected, as those releases produced and broadcast unscoped automation test results. The fix is implemented in 3.39.25 and later versions of Budibase.

The vulnerability carries a CVSS score of 5.7, indicating a medium risk level. There is no EPSS score available, and the issue is not listed in the CISA KEV catalog, suggesting it is not a widely exploited vulnerability at this time. The attack vector is inferred from the description: a co‑builder in the same Budibase workspace can capture the broadcasted event and retrieve the OAuth2 tokens. Therefore, the exploitation requires legitimate access to the Budibase workspace and the ability to observe or poll the automation test progress event.