Budibase OIDC/SSO Auth Bypass Lets Attacker Claim Admin Invite — CVE-2026-100684
Photo: Forkast
A critical authentication bypass in the Budibase low-code platform allows unauthenticated remote attackers to hijack pending administrative invitations. By exploiting flaws in the OIDC/SSO login flow, an attacker can claim an invite intended for another user, inheriting the privileges associated with that invitation, including global administrator access. The vulnerability, tracked as CVE-2026-100684 , carries a CVSS v4.0 score of 9.2. The vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) confirms low attack complexity. The AT:P component denotes environmental prerequisites rather than technical barriers: the target environment must have OIDC/SSO enabled and at least one pending user invitation must exist.
Source: Forkast
