CVE-2026-100681
Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submit a crafted POST request to inject an attacker-controlled serviceUrl that is persisted and used for all subsequent bot replies, causing the server to send live Microsoft OAuth access tokens in Authorization headers to the attacker's host and enabling blind internal network access.
| CWE | CWE-918 |
| Vendor | budibase |
| Product | server |
| Published | Sep 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for budibase server
Be the first to know when new medium vulnerabilities affecting budibase server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
budibase / server
0 < 3.45.0
References
Credits
🔍 csidhant