Critical 9.1 Auth Bypass Hits Budibase Operations Platform

Budibase issued a high-priority security update to address a critical CVSS 9.1 authentication bypass where unanchored regex patterns in the authentication middleware allowed attackers to append public endpoint paths in query strings and gain unauthenticated access to protected administrative endpoints; the flaw enables full user enumeration and other administrative actions and is fixed in version 3.35.4 by anchoring regex patterns and switching to ctx.request.path.