Budibase backend-core sets the authentication session cookie 'budibase:auth' with httpOnly:false, allowing JavaScript access to the JWT token. This misconfiguration, combined with existing stored XSS vulnerabilities, enables attackers to steal session tokens via XSS and achieve full account takeover. The cookie also lacks the secure and sameSite flags, increasing exposure to interception and cross-site request forgery. This affects all versions prior to 3.35.10, where the issue is fixed.