CVE-2026-73308

Received Received - Intake

OAuth2 Token Exposure in Budibase Automation Test Results

Publication date: 2026-08-12

Last updated on: 2026-08-14

Assigner: GitHub, Inc.

Description

Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts returned automation test results containing trigger.outputs.user.oauth2, broadcast BuilderSocketEvent.AutomationTestProgress to the app room, and stored progress in packages/server/src/automations/testProgress.ts without user scoping. A co-builder could receive or poll another SSO-authenticated builder test and obtain OAuth2 access and refresh tokens. The fix adds sanitizeAutomationTestResult and isolates progress by user. This issue is fixed in version 3.39.25.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-14

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-73308

EUVD

EUVD-2026-57432

Affected Vendors & Products

Vendor	Product	Version / Range
budibase	budibase	3.39.25

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability in Budibase (CVE-2026-73308) involves OAuth2 tokens being exposed in automation test results. When a user tests an automation, their OAuth2 access and refresh tokens are included in the output. These results are broadcast to other builders in the same app and stored in a cache. Other users can steal these tokens, gaining unauthorized access to external services like Google Workspace or Azure AD.

Detection Guidance

Check Budibase server logs for automation test results containing OAuth2 tokens in outputs or inputs. Review WebSocket traffic for broadcasted automation test progress events. Inspect in-memory cache for stored test progress without user isolation.

Impact Analysis

If you use Budibase with SSO-authenticated builders, an attacker with access to the same app could steal your OAuth2 tokens. This allows them to impersonate you in connected services, access sensitive data, or maintain long-term access via refresh tokens. The attack requires another builder in the same app to exploit this.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's access controls. Exposure of OAuth tokens may result in data breaches, triggering compliance violations and potential fines.

Mitigation Strategies

Upgrade Budibase to version 3.39.25 or later. Review and remove any exposed OAuth2 tokens from past automation test results. Ensure all co-builders are aware of the risk and rotate any potentially compromised tokens.

Hi! I’m here to help you understand CVE-2026-73308. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70