GHSA-gh4h-34gr-87r7

Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders

Published

2026-07-24

Modified

2026-07-24

Sources

github-advisory

Summary

## Summary When an SSO-authenticated user tests an automation in the Budibase builder, their OAuth2 access token and refresh token are included in the automation test results. These results are broadcast via WebSocket to all builders connected to the same dev app and stored in an in-memory cache accessible to any builder who polls the test status endpoint. This allows any co-builder of the same app to steal the testing user's OAuth2 tokens. ## Details The vulnerability exists because `getUserContextBindings()` intentionally includes OAuth2 tokens in user context bindings (so automations can call external APIs), but the automation test pipeline exposes the full result — including these tokens — to all builders of the same app without sanitization. **Step 1: Tokens included in user bindings** In `packages/server/src/sdk/users/utils.ts:134-161`: ```typescript export function getUserContextBindings(user: ContextUser): UserBindings { const bindings: UserBindings = { _id: user._id, email: user.email, // ... } if (isSSOUser(user) && user.oauth2) { bindings.oauth2 = { accessToken: user.oauth2.accessToken, // /test?async=true \ -H 'x-budibase-app-id: app_dev_ ' \ -H 'Cookie: budibase:auth= ' \ -H 'Content-Type: application/json' \ -d '{"row": {"tableId": "ta_xxx"}}' # Returns: {"message": "Automation test started"} # Step 2: User B (another builder on the same app) polls the test status curl -X GET http://localhost:10000/api/automations/ /test/status \ -H 'x-budibase-app-id: app_dev_ ' \ -H 'Cookie: budibase:auth= ' # Response includes the full automation result with: # result.trigger.outputs.user.oauth2.accessToken = "ya29.a0AfH6SM..." # result.trigger.outputs.user.oauth2.refreshToken = "1//0eXyz..." ``` Additionally, User B can passively receive the tokens by simply having the Budibase builder open (connected via WebSocket), as the `BuilderSocketEvent.AutomationTestProgress` event with `status: "complete"` includes the full result payload. ## Impact - **OAuth2 access tokens** for external services (Google Workspace, Azure AD, GitHub, etc.) ar

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-gh4h-34gr-87r7