{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.38.1"}],"component":"@budibase/server","cve_ids":["CVE-2026-73302"],"ecosystem":"npm","epss":0.00427,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-hp6v-6jw7-gv2f","id":"tcs_01M5KFVNTJPPCMFZ58TJABTVSY","modified_at":"2026-08-12T19:11:12.967676Z","published_at":"2026-07-24T21:17:39Z","references":["https://osv.dev/vulnerability/GHSA-hp6v-6jw7-gv2f","https://github.com/Budibase/budibase/security/advisories/GHSA-hp6v-6jw7-gv2f","https://github.com/Budibase/budibase/commit/9ecd0048d9c3ae0ee9bd0e6204c621794dd1a4d3","https://github.com/Budibase/budibase","https://github.com/Budibase/budibase/releases/tag/3.39.30"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-hp6v-6jw7-gv2f","url":"https://osv.dev/vulnerability/GHSA-hp6v-6jw7-gv2f"}],"summary":"Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified"}