Threats Tagged 'ghsa-hp6v-6jw7-gv2f'
View all threats tagged with 'ghsa-hp6v-6jw7-gv2f'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ghsa-hp6v-6jw7-gv2f'
Click on any threat for detailed analysis and mitigation recommendations
Server: Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified 0 Budibase's OIDC SSO implementation links incoming identities to existing accounts solely by email without verifying the email_verified claim. This allows an attacker who can authenticate via a trusted IdP and have it assert the victim's email with email_verified=false to take over the victim's Budibase account, inheriting all roles including admin. The vulnerability arises because Budibase does not check the email_verified flag as required by OIDC Core §5.7 and blindly trusts the email claim from any configured IdP. This affects Budibase versions up to 3.38.1. Join the discussion | GCVE Database | 07/24/2026, 21:17:39 UTC Added: 07/25/2026, 23:09:34 UTC |
Showing 1 to 1 of 1 result