What’s Vulnerable › Vulnerabilities

CVE-2026-73308: Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders

• Severity: medium (CVSS 5.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-12 · updated 2026-09-08
• Weakness: CWE-200

Description

Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts returned automation test results containing trigger.outputs.user.oauth2, broadcast BuilderSocketEvent.AutomationTestProgress to the app room, and stored progress in packages/server/src/automations/testProgress.ts without user scoping. A co-builder could receive or poll another SSO-authenticated builder test and obtain OAuth2 access and refresh tokens. The fix adds sanitizeAutomationTestResult and isolates progress by user. This issue is fixed in version 3.39.25.

Affected products

• budibase: before 3.39.25

References

• https://github.com/Budibase/budibase/commit/bca426de7dc36d680285295655dc640dea2aab21
• https://github.com/Budibase/budibase/pull/19107
• https://github.com/Budibase/budibase/releases/tag/3.39.25
• https://github.com/Budibase/budibase/security/advisories/GHSA-gh4h-34gr-87r7
• https://github.com/Budibase/budibase/security/advisories/GHSA-gh4h-34gr-87r7

Get alerted when CVE-2026-73308 or the next vulnerability affects your stack