Critical authentication bypass flaw reported in AI coding platform Base44
Take action: You can't do much about the flaw, it's already patched. If your organization uses Base44 for applications, review them for any suspicious user registrations or unusual access patterns. If you are developing applications, NEVER code undocumented endpoints and API interfaces, especially without a proper authentication. Security by obscurity doesn't work.
Learn More
Wiz Research has disclosed a critical authentication bypass vulnerability in Base44, a popular AI-powered "vibe coding" platform that allowed unauthorized access to private enterprise applications built by users across the platform.
The security flaw has no CVE tracking number. It affected the Base44 platform's authentication mechanisms. The vulnerability was caused by misconfigured API endpoints that allowed attackers to bypass all authentication controls, including Single Sign-On (SSO) protections, by exploiting undocumented registration and email verification endpoints. The vulnerability affected two API endpoints: api/apps/{app_id}/auth/register for registering new users and api/apps/{app_id}/auth/verify-otp for verifying users with one-time passwords.
By providing only a non-secret app_id value to the registration and email verification endpoints, an attacker could have created a verified account for private applications on their platfom. The app_id values required for exploitation were not secret and were easily discoverable:
- When navigating to any application developed on Base44, the app_id is immediately visible in the URI.
- All applications having their app_ids hardcoded in their manifest path: manifests/{app_id}/manifest.json
Wiz Research identified vulnerable applications by simple DNS reconnaissance and URL scanners to identify domains and applications related to base44. The researchers successfully confirmed that authentication bypass was available across multiple base44 applications used for internal chatbots, knowledge bases, and PII operations.
The number of affected individuals has not been disclosed, though Base44 platform was reported to have over 20,000 users as of March 2025, with millions of applications created across the platform.
Wiz Research disclosed the vulnerability to both Base44 on July 9, 2025 and a fix was deployed within 24 hours on July 10, 2025. Wix claims that there was no evidence of past abuse and that the investigation found no indication of compromise across the Base44 user base.
Organizations using Base44 should review their application analytics for any unusual user visits and registrations.
