Documented incidentDisclosed 2025-07-09Base44 (Wix)Research paper

Non-secret app ID lets anyone register for private apps built on the Base44 AI app builder (2025)

By supplying only an application's non-secret appid to undocumented registration and email-verification endpoints, an attacker could create a verified account on private applications built with Base44.

What happened

  • By supplying only an application's non-secret app_id to undocumented registration and email-verification endpoints, an attacker could create a verified account on private applications built with Base44.Wiz Research Uncovers Critical Vulnerability in AI Vibe Coding Platform Base44
  • This bypassed every authentication control the platform offered, including single sign-on, giving access to private enterprise apps and their data.Wiz Research Uncovers Critical Vulnerability in AI Vibe Coding Platform Base44
  • Wiz reported it on July 9, 2025; Wix fixed it within 24 hours by validating app privacy settings before registration and found no evidence of past abuse.Wiz Research Uncovers Critical Vulnerability in AI Vibe Coding Platform Base44

The failure pattern

Cross-tenant access through a caller-controlled identifierThe server trusts an account, tenant or object ID sent by the client, so changing a number reveals someone else's data.How to prevent it
Watch the pattern: Cross-tenant access through a caller-controlled identifier

Safeguards that address it

CollectSEA's engineering analysis of what would have prevented or contained this failure.

  • Never use an identifier as an authorization checkAn app or tenant id says which resource is meant, not that the caller may access it; enforce each app's access policy on every endpoint.
  • Inventory and protect undocumented endpointsApply the same authentication and privacy checks to internal or undocumented APIs as to the documented sign-in flow.

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern

Security advisory2026-10-16

Software component issue could allow unauthorized access

ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing…

Cross-tenant access through a caller-controlled identifiernvd.nist.gov
Security advisory2026-10-16

Software component issue could allow unauthorized access

The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is…

Cross-tenant access through a caller-controlled identifiernvd.nist.gov