A severe authentication bypass vulnerability in Base44, a popular AI-powered vibe coding platform recently acquired by Wix, could have allowed attackers unauthorized access to private enterprise applications and sensitive corporate data. Attackers could leverage undocumented API endpoints /api/apps/{app_id}/auth/register and /api/apps/{app_id}/auth/verify-otp to create verified accounts for private applications, effectively bypassing all authentication controls, including Single Sign-On (SSO) protections. The vulnerability’s impact extended beyond individual applications due to the vibe coding platforms’ shared infrastructure model, where all customer applications inherit the vendor’s security posture. During the research period, multiple enterprise applications were confirmed vulnerable, including internal chatbots, knowledge bases, and HR operations systems containing personally identifiable information (PII). The company confirmed no evidence of malicious exploitation during the vulnerable period and has since verified that proper validation now prevents unauthorized registration attempts on private applications.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 31 Jul 2025 02:45:21 +0000