Budibase is an open-source low-code platform. Prior to 3.39.0, fetchToken in the OAuth2 SDK makes a POST to a builder-supplied URL with plain node-fetch, skippi…

Budibase open-source low-code platform contains a vulnerability in versions prior to 3.39.0. The fetchToken function in the OAuth2 SDK makes POST requests to builder-supplied URLs using plain node-fetch, bypassing the blacklist.isBlacklisted security check that other outbound fetch operations use. The Joi schema for OAuth2 URLs lacks scheme and host restrictions, allowing potential SSRF attacks. This security flaw has been addressed in version 3.39.0.