Budibase's OIDC Single Sign-On (SSO) login process attempts to match incoming identities first by the IdP subject (sub) claim, and if no match is found, falls back to matching by the email claim without checking the email_verified flag. Because Budibase never verifies whether the email is confirmed (email_verified=true), an attacker who can authenticate through a trusted IdP and have it assert the victim's email with email_verified=false can gain access to the victim's Budibase account. The attacker inherits the victim's user ID and roles, including global admin privileges. This violates OIDC Core specification §5.7, which mandates that the email claim must only be used as an identity key if email_verified is true. The vulnerability requires the attacker to authenticate via a trusted IdP that allows unverified email assertions, such as Keycloak or Authentik with default settings that disable email verification. Budibase versions up to and including 3.38.1 are affected. No patch information is provided in the advisory.

An attacker who can authenticate through a trusted IdP and have it assert the victim's email with email_verified=false can fully take over the victim's Budibase account. This includes inheriting all roles and permissions, such as global admin or builder roles. The attacker can thus gain unauthorized administrative control over the Budibase instance, leading to complete compromise of the affected user accounts. The vulnerability undermines the trust model of OIDC SSO by ignoring the email verification status, allowing account takeover via unverified email assertions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should ensure that all configured IdPs enforce strict email verification policies (email_verified=true) before asserting email claims. Avoid trusting IdPs that allow unverified email assertions or permit self-registration without email verification. Consider disabling or restricting OIDC SSO login from IdPs with permissive email verification settings. Monitor vendor communications for updates and patches addressing this issue.