CVE-2026-42239 - Vulnerability Analysis
HighCVSS: 8.1Last Updated: May 7, 2026
Budibase - Stored XSS & Authentication Bypass
Published: May 7, 2026Updated: May 7, 2026Remote Exploitable
Overview
Budibase < 3.35.10 contains a stored XSS vulnerability caused by the budibase:auth cookie being set with httpOnly: false, allowing JavaScript access to the JWT session token, letting attackers perform full account takeover via XSS, exploit requires XSS vulnerability.
Severity & Score
Severity: High
CVSS Score: 8.1
Impact
Attackers can steal JWT tokens via XSS, leading to full account takeover and persistent access to victim accounts.
Mitigation
Update to version 3.35.10 or later.
References
Related Resources
Details
- CVE ID
- CVE-2026-42239
- Severity
- High
- CVSS Score
- 8.1
- Type
- stored_xss
- Status
- unconfirmed
CWE
- CWE-1004
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N