A sensitive cookie configuration flaw in Budibase prior to version 3.35.10 allows attackers to hijack user sessions via cross-site scripting, leading to potential account takeover.

This is a sensitive cookie without HttpOnly flag vulnerability categorized as CWE-1004, where session tokens are exposed to JavaScript, requiring high privileges and user interaction to exploit in conjunction with cross-site scripting.

The exploitation of this vulnerability can result in full account takeover, granting unauthorized access to sensitive low-code applications, internal data, and administrative controls. With a CVSS score of 8.1, the high severity reflects the severe impact of compromised session integrity and potential lateral movement within the environment.

Immediate Action: Update the Budibase platform and the @budibase/backend-core package to version 3.35.10 or later immediately.

Proactive Monitoring: Monitor authentication logs and application monitoring tools for unusual session creation patterns or unauthorized administrative actions.

Compensating Controls: Deploy a Web Application Firewall to inspect traffic for cross-site scripting attempts and enforce strict Content Security Policies.

Public Exploit Available: false

Given the high CVSS score and the severe risk of session hijacking, administrators must prioritize applying the vendor security update to version 3.35.10. Verifying cookie attributes and reviewing existing cross-site scripting protections will ensure comprehensive risk mitigation.