CVE-2026-73306 in Budibase
Summary
by MITRE • 08/12/2026
Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and Retry-After only for locked identifiers. An unauthenticated attacker could compare the response after repeated failures to enumerate valid email addresses and temporarily lock valid accounts. This issue is fixed in version 3.39.25.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability affects Budibase's authentication system where the platform fails to properly handle account enumeration attacks through login attempts. The flaw exists in the interaction between two distinct components within the authentication flow, creating a timing-based information leak that allows attackers to distinguish between valid and invalid email addresses. When users attempt to log in with credentials, the system increments failure counters only for existing accounts but does not consistently apply lockout mechanisms across all identifier types.
The technical implementation reveals a critical design flaw in how the system handles authentication failures. In packages/worker/src/api/controllers/global/auth.ts, the failure counter logic specifically targets existing user accounts while in packages/worker/src/middleware/emailLockout.ts, the lockout response headers X-Account-Locked and Retry-After are only sent for identifiers that have been locked. This inconsistency creates a predictable timing difference that attackers can exploit to determine which email addresses correspond to valid accounts within the system.
The operational impact of this vulnerability is significant as it enables account enumeration attacks without requiring authentication credentials. An unauthenticated attacker can systematically test email addresses by repeatedly attempting login operations and observing response differences. Valid email addresses will trigger different response patterns compared to invalid ones, allowing attackers to build a list of legitimate user accounts. Additionally, the vulnerability permits temporary account lockouts for valid users through repeated failed attempts, potentially enabling denial-of-service attacks against legitimate users.
This issue represents a classic example of information disclosure through timing variations and falls under CWE-208 Information Exposure Through Timing Differences. The vulnerability also aligns with ATT&CK technique T1593 Reconnaissance, where attackers gather information about the target system through indirect means such as account enumeration. The root cause stems from improper handling of authentication responses and inconsistent security controls across different parts of the authentication pipeline.
The fix implemented in version 3.39.25 addresses this vulnerability by ensuring consistent failure counter incrementation for all login attempts regardless of account existence, while also applying uniform lockout mechanisms across all identifiers. This prevents attackers from distinguishing between valid and invalid email addresses through response timing analysis, thereby eliminating the account enumeration capability that was previously possible through repeated authentication attempts.
Organizations using Budibase should immediately upgrade to version 3.39.25 or later to mitigate this vulnerability. Security teams should also implement monitoring for unusual login patterns and consider additional rate limiting measures beyond the built-in lockout functionality. The fix demonstrates proper security engineering principles by ensuring that authentication responses do not leak information about account validity, which is essential for maintaining the confidentiality and integrity of user authentication systems.