CVE-2026-73302 | Budibase up to 3.39.29 OIDC Flow oidc.ts users.getGlobalUserByEmail assertion

August 14, 2026 Yanac

A vulnerability categorized as critical has been discovered in Budibase up to 3.39.29. This affects the function users.getGlobalUserByEmail of the file packages/backend-core/src/middleware/passport/sso/oidc.ts of the component OIDC Flow. Such manipulation leads to reachable assertion.

This vulnerability is documented as CVE-2026-73302. The attack can be executed remotely. There is not any exploit available.

It is advisable to upgrade the affected component.VulDB Recent EntriesRead More