VibeBase44 auth bypass let outsiders register for private, SSO-only apps
Incident dateNot stated
DisclosedJul 29, 2025 (Wiz). Reported privately Jul 9, 2025.
Added hereOct 13, 11:49 PM ET
Last verifiedOct 14, 2026
Summary
Wiz Research found that two undocumented Base44 endpoints let anyone create a verified account on a private app using only its app_id, which is visible in the app's URL and manifest. That bypassed SSO-only settings. Wix fixed it in under 24 hours and said it found no evidence of abuse.
Severity
CRITICAL Full bypass of the platform's strongest access setting, across every app. Fixed fast, with no known exploitation.
Timeline
Wiz reports to Wix and Base44; Wix acknowledges.
Wiz verifies the fix.
Wix confirms resolution and no sign of compromise.
Public disclosure.
How it happened
The register and verify-otp endpoints under api/apps/{app_id}/auth/ did not check the app's privacy settings. Public Swagger docs listed them. Because app IDs are not secrets, a new user could sign up, verify by email, and then pass the SSO login page.
How to check your app
- Do not treat IDs in URLs as secrets. Every endpoint must check permissions on the server.
- Check that sign-up is actually disabled server-side when your app is invite-only, not just hidden in the UI.
- Base44 users: review the data/analytics section for unexpected registrations on private apps on or before July 9, 2025, as Wiz suggests.
Sources
Corrections and updates
If you want a quick way to check the basics above on your own app, LockedVibe publishes a free Lockdown Pack with the prompts and checks for RLS, auth and exposed keys.