Budibase OIDC/SSO Auth Bypass Lets Attacker Claim Admin Invite — CVE-2026-100684

A critical authentication bypass in the Budibase low-code platform allows unauthenticated remote attackers to hijack pending administrative invitations. By exploiting flaws in the OIDC/SSO login flow, an attacker can claim an invite intended for another user, inheriting the privileges associated with that invitation, including global administrator access. The vulnerability, tracked as CVE-2026-100684 , carries a CVSS v4.0 score of 9.2. The vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) confirms low attack complexity. The AT:P component denotes environmental prerequisites rather than technical barriers: the target environment must have OIDC/SSO enabled and at least one pending user invitation must exist. The flaw affects Budibase Server versions 3.41.0 through 3.44.x , with a fix implemented in version 3.45.0. The root cause resides in the sso.authenticate function.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Forkast.