Breaches
Base44's private apps could be joined by anyone who knew a public ID
Companies used Base44 to build internal tools for HR data and knowledge bases, locked behind single sign-on. Wiz found that two unprotected endpoints let anyone create an account on them using an ID printed in the URL.
3 min read