CVE-2026-100684 is an authentication bypass vulnerability in Budibase server's OIDC/SSO login implementation affecting versions >=3.41.0 and <3.45.0. The vulnerability arises because the server's sso.authenticate function, when no existing user matches the incoming SSO subject, looks up pending user invites solely by the IdP-asserted email address without validating the invite code or checking if the email is verified. The email_verified check is only applied when matching existing accounts, not pending invites. An attacker able to register at a trusted IdP and assert a victim's invited email address—even with email_verified=false—can claim the pending invite and gain all associated privileges, including admin.global. This leads to takeover of the invited principal and full tenant compromise, exposing all apps, datasources (including production credentials), and automations. The invite is consumed, preventing the legitimate invitee from onboarding.

Successful exploitation results in complete tenant takeover, including access to all applications, data sources with production credentials, and automation workflows. The attacker inherits all privileges granted by the pending invite, including administrative rights, and denies onboarding to the legitimate invited user. This compromises the confidentiality, integrity, and availability of the tenant's resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or monitor registrations at trusted identity providers to prevent attackers from asserting victim email addresses. Review and tighten invite validation logic if possible. Avoid relying solely on email assertions without invite code and email verification checks.