CVE-2026-100684

Executive Summary

CVE-2026-100684 is an authentication bypass in the OIDC/SSO login path of Budibase (@budibase/server) affecting versions 3.41.0 before 3.45.0. When no existing user matches an incoming SSO subject, the server resolves pending user invites by IdP-asserted email alone, omitting invite-code validation and the email_verified check for that lookup path. An attacker controlling an identity at any OIDC-trusted IdP can assert a victim's invited email address and inherit the invite's granted privileges — including builder and admin.global — resulting in takeover of the invited principal and, for admin invites, full tenant compromise.

Technical Analysis

The vulnerability resides in the OIDC/SSO authentication flow of Budibase's server component, specifically within sso.authenticate. Under normal operation, two distinct resolution paths exist for an inbound SSO assertion:

1. Existing-account lookup: The server matches the SSO subject to an existing user record. This path applies an email_verified gate, ensuring the IdP has asserted and verified ownership of the email address before granting a session.

2. Pending-invite lookup: When no existing user matches the SSO subject, the server attempts to bind the authentication to a pending user invite. Per the NVD description, this path looks up pending invites by the IdP-asserted email address alone — it does not validate an invite code, and it does not apply the email_verified gate.

The consequence is an asymmetry in trust enforcement. The email_verified claim is honored only on the existing-account branch; the invite-claim branch treats the asserted email as sufficient proof of identity. Because OIDC providers vary widely in what assertions they emit and how account registration is governed, an attacker who can register an account at any IdP that the target tenant trusts for OIDC can place an arbitrary email address — including one belonging to a pending invite — into the assertion stream.

The root cause class is CWE-287 (Improper Authentication). The mechanism is a broken identity-binding decision: the server conflates "an IdP signed this assertion" with "this subject is the legitimate holder of the asserted email." Invite codes exist precisely to bridge that gap for the invite path — they are a bearer secret delivered out-of-band to the invited party. Skipping code validation removes the only factor that would have prevented an unrelated IdP account from claiming the invite. Applying email_verified only to the existing-user branch compounds the flaw, because the invite branch is the one where the email claim is least trustworthy (the invitee may not have an account at that IdP at all).

The impact of claiming an invite is not limited to onboarding: the invite's stored grant set is inherited in full. The description explicitly notes that grants can include builder and admin.global, and that no admin exclusion is applied to the invite-claim path. There is no safety check downgrading or rejecting invites that carry administrative scopes.

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. Technical characterization above is derived strictly from the NVD description; no additional function names, endpoints, or parameters beyond sso.authenticate and the email_verified concept should be assumed.

Exploitation Scenarios

Preconditions: The target Budibase tenant (3.41.0 ≤ version < 3.45.0) must have OIDC/SSO configured and must trust an IdP at which the attacker can provision an identity. At least one pending user invite must exist for the email address the attacker intends to assert. The attacker needs no prior account on the Budibase instance itself (PR:N in the CVSS vector).

Step 1 — Reconnaissance / target identification. The attacker identifies a Budibase deployment using OIDC/SSO and determines which IdP(s) the tenant trusts. Social or organizational reconnaissance identifies a pending or likely invite — for example, a newly announced hire, a contractor onboarding, or an administrative role being filled — whose owner has been invited but has not yet completed signup, leaving the invite pending.

Step 2 — IdP-side identity positioning. The attacker registers an account at an IdP that the tenant trusts for OIDC and arranges for the assertion it emits to carry the victim's invited email address as the email claim. Critically, per the description, this works even with email_verified=false — the attacker is not required to prove control of the victim's mailbox, because the invite-claim lookup path does not consult that claim.

Step 3 — Triggering the flaw. The attacker initiates the SSO login flow against the Budibase instance. With no existing user matching the attacker's SSO subject, the server enters the pending-invite path in sso.authenticate. The server queries pending invites by the asserted email address alone — no invite code is validated and no email_verified check is enforced. The pending invite for the victim's email matches, and the attacker's session is bound to it.

Step 4 — Post-exploitation impact. The attacker inherits the invite's full grant set. Where the invite is a normal builder invite, the attacker obtains builder access to the tenant's applications. Where the invite is an administrative invite, the attacker gains admin.global, yielding full tenant compromise in line with the CVSS impact subscores (C:H/I:H/A:H) — access to all apps, all datasources including production credentials, and automations. The invite is also consumed as part of the claim, denying onboarding to the legitimate invitee and creating a denial-of-service condition for the intended principal.

No public PoC is available; the attack chain above is inferred from the documented vulnerability class (improper authentication / broken identity binding) and the explicit behavioral details in the NVD description.

Impact Assessment

CVSS 3.1 base score is 8.1 (High) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H:

• AV:N — the flaw is reachable over the network via the OIDC/SSO login path; no local access is required.
• AC:H — exploitation depends on conditions beyond the attacker's direct control: an OIDC-trusted IdP the attacker can register with, the ability to assert an arbitrary email claim, and the existence of a pending invite for the targeted address.
• PR:N — no privileges on the Budibase instance are needed; the IdP-side account is external to the target.
• UI:N — no victim interaction is required; the legitimate invitee need not click anything for the claim to succeed.
• S:U — impact is scoped to the vulnerable Budibase tenant authorization context.
• C:H/I:H/A:H — full loss of confidentiality, integrity, and availability within the tenant upon successful claim of a privileged invite.

Blast radius: A claimed builder invite exposes the tenant's application logic and data accessible to builders. A claimed admin.global invite is a full tenant compromise — all applications, datasource configurations including production credentials, and automation definitions become attacker-accessible, enabling data exfiltration, lateral movement into connected systems using stored credentials, and persistent manipulation of automations. The consumption of the invite additionally blocks the legitimate invitee from onboarding, producing an operational disruption that may also serve as cover for the compromise. Affected systems are self-hosted and cloud Budibase deployments running 3.41.0 ≤ version < 3.45.0 with OIDC/SSO enabled and pending invites present. Instances without OIDC configured, or without pending invites, are not exposed to this specific chain.

Detection Guidance

Sigma Rule

title: Budibase OIDC Invite Claim Without Email Verification
id: 8f3c1a52-7d2e-4b91-9c44-budibase100684
status: experimental
description: Detects SSO/OIDC authentication that claims a pending invite, particularly assertions carrying email_verified=false. Maps to CVE-2026-100684.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100684
author: valtersit.com
date: 2026-01-01
logsource:
  product: budibase
  service: sso
detection:
  selection_event:
    event.action: 'sso.authenticate'
  selection_invite:
    invite.claimed: true
  selection_unverified:
    email_verified: false
  condition: selection_event and (selection_invite or selection_unverified)
falsepositives:
  - Legitimate IdPs configured to emit email_verified=false for federated identities
  - Invite flows where users legitimately redeem invites via SSO
level: high
tags:
  - attack.t1078
  - cve.2026-100684
  - cwe.287

YARA Rule

rule CVE_2026_100684_Budibase_SSO_Invite_Claim
{
    meta:
        description = "Detects Budibase server artifacts referencing OIDC SSO invite-claim logic associated with CVE-2026-100684"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100684"
        date = "2026-01-01"
        cve = "CVE-2026-100684"
    strings:
        $s1 = "sso.authenticate" ascii wide nocase
        $s2 = "email_verified" ascii wide nocase
        $s3 = "OIDC" ascii wide nocase
        $s4 = "pending invite" ascii wide nocase
        $s5 = "admin.global" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or
        (2 of them)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100684 Budibase OIDC Invite-Claim Authentication Bypass"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"oidc"; nocase; http.uri; content:"callback"; nocase; http.header; content:"email_verified"; nocase; http.header; content:"false"; nocase; sid:2026100684; rev:1; reference:cve,2026-100684; classtype:attempted-admin; metadata:service http;)

Elastic Detection

sequence by source.ip with maxspan=2m
  [ authentication where event.action == "sso.authenticate" and oidc.email_verified == false ]
  [ authentication where event.action == "sso.authenticate" and invite.claimed == true ]

Splunk SPL Query

index=budibase sourcetype=budibase:server
| search "sso.authenticate" ("invite" OR "email_verified")
| eval unverified=if(match(_raw,"email_verified[\"'\s:=]+false"),1,0)
| eval invite_claim=if(match(_raw,"invite") AND match(_raw,"claim"),1,0)
| where unverified=1 OR invite_claim=1
| stats count min(_time) as first_seen max(_time) as last_seen values(user) as users values(src_ip) as src_ips by host
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="budibase,authentication,">
  <rule id="100684" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.action">sso.authenticate</field>
    <field name="email_verified">false</field>
    <description>CVE-2026-100684: Budibase OIDC SSO login with email_verified=false - possible invite-claim authentication bypass.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_bypass,cve_2026_100684,</group>
  </rule>
  <rule id="100685" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.action">sso.authenticate</field>
    <field name="invite.claimed">true</field>
    <description>CVE-2026-100684: Budibase pending invite claimed via SSO - verify invitee identity and invite code validation.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_bypass,cve_2026_100684,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list is available from tracked sources. The following measures are defensive recommendations based on the vulnerability mechanism; they are not vendor-confirmed fixes.

1) Immediate mitigations

• Disable OIDC/SSO login on affected Budibase instances (3.41.0 ≤ version < 3.45.0) until the invite-claim path enforces invite-code validation and the email_verified gate. Falling back to first-party authentication removes the exposed assertion pathway.
• Audit the IdP trust configuration. Restrict OIDC trust to IdPs that enforce verified-email ownership and do not permit open self-registration, reducing the attacker's ability to assert arbitrary email claims.
• Eliminate standing pending invites where possible. Since exploitation requires a pending invite, minimize invite lifetime and cancel stale or unclaimed invites, especially any carrying builder or admin.global grants.
• Do not issue invites with administrative scopes (admin.global) or elevated grants via email-identified SSO flows; onboard privileged principals through verified, code-bound channels.
• Monitor SSO authentication logs for invite claims accompanied by email_verified=false, which is the signature condition of this flaw.

2) Patch/upgrade steps

• Track the Budibase release channel for a fix addressing the invite-claim path in sso.authenticate. No patched version identifier is available at this time; upgrade only to a release that vendor advisories confirm resolves CVE-2026-100684.
• If a patched build cannot be deployed immediately, treat the instance as exposed and apply the mitigations above. Verify the fix by confirming that invite claims require a valid invite code and that email_verified is enforced on both the existing-account and pending-invite lookup paths.

3) Long-term hardening

• Enforce email_verified (or equivalent assurance) uniformly across all SSO identity-resolution paths, including invite redemption — never gate it to a single branch.
• Require invite-code (or equivalent out-of-band secret) validation whenever an SSO assertion is bound to a pending invite, treating the code as the identity-binding factor.
• Implement an explicit admin-scope exclusion or step-up requirement so administrative invites cannot be claimed purely through IdP-asserted email.
• Apply least privilege to invite grants and require re-authentication for privileged operations after invite redemption.
• Adopt continuous monitoring of SSO authentication events and alert on anomalies such as invite claims by newly created IdP subjects or repeated failed invite-code validations.

References

• NVD — CVE-2026-100684: https://nvd.nist.gov/vuln/detail/CVE-2026-100684
• CWE-287 — Improper Authentication: https://cwe.mitre.org/data/definitions/287.html
• Budibase project documentation and release notes (OIDC/SSO configuration): https://docs.budibase.com
• MITRE ATT&CK — T1078 Valid Accounts: https://attack.mitre.org/techniques/T1078/
• CISA Known Exploited Vulnerabilities Catalog (not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, or evidence of in-the-wild exploitation or threat-actor campaigns is available for CVE-2026-100684 at the time of writing. CISA KEV status: not listed.