Critical authentication bypass in Base44 vibe coding platform
Wiz Research discovered a critical vulnerability in Base44, a code generation platform, that allowed attackers to bypass authentication by using only a non-secret app_id to create verified accounts. The vulnerability enabled unauthorized access to private applications and sensitive data, but was patched within 24 hours with no evidence of exploitation.
What happened
Wiz Research identified a critical vulnerability in Base44's authentication system that allowed attackers to bypass all authentication controls, including Single Sign-On (SSO), by providing only a non-secret app_id value to undocumented registration and email verification endpoints.
The vulnerability enabled attackers to create verified accounts for private applications and gain full access to sensitive corporate data stored within them.
Reported impact
The vulnerability could have granted unauthorized access to private applications built by enterprise users and the sensitive data they contained.
Index analysis
The platform runs all applications on shared infrastructure, creating shared-risk conditions where a vulnerability affects the entire ecosystem of applications hosted on the platform.
Governance controls
Upon discovery, Wiz Research responsibly disclosed the vulnerability to both Base44 and Wix. The vulnerability was patched within 24 hours, with Wix confirming there was no evidence of past abuse.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.