p PatchFirst

CVE-2026-73308

CVE-2026-73308 · Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts returned automation test results containing trigger.outputs.user.oauth2, broadcast BuilderSocketEvent.AutomationTestProgress to the app room, and stored progress in packages/server/src/automations/testProgress.ts without user scoping. A co-builder could receive or poll another SSO-authenticated builder test and obtain OAuth2 access and refresh tokens. The fix adds sanitizeAutomationTestResult and isolates progress by user. This issue is fixed in version 3.39.25.

CVSS 5.7 · Media · EPSS 0,4%

Publicación
Actualización

Pila tecnológica: node

Productos y versiones afectados

  • budibase

    Versiones
    • < 3.39.25: Afectada

    Sin corrección publicada

  • @budibase/server npm

    Intervalos de versiones afectados
    • SEMVER: ≤ 3.38.1

    Sin corrección publicada

Fuentes originales

Comprueba tu servidor →