Threats tagged 'ghsa-g8px-vqwp-7rg7'

Budibase server versions 3.41.0 up to but not including 3.45.0 contain a critical authentication bypass vulnerability in the OIDC/SSO login path. The flaw allows an attacker who can register at a trusted IdP to claim a pending user invite by asserting the victim's invited email address without proper validation of the invite code or email verification. This enables the attacker to inherit all privileges granted to the invite, including admin rights, leading to full tenant compromise and denial of onboarding to the legitimate invitee.