Wiz Finds Base44 Authentication Flaw That Exposed Private Applications

Summary

Wiz says unauthenticated Base44 registration and OTP endpoints let attackers use public app IDs to bypass SSO and access private apps. Wix fixed the flaw within 24 hours; it reported no evidence of exploitation.

Key points

Wiz researchers found that unauthenticated registration and OTP-verification endpoints accepted an application's non-secret app_id.
App IDs were exposed in application URLs and manifest paths, enabling account creation and verification for private apps.
The researchers confirmed that the flaw could bypass SSO protections on enterprise applications, including chatbots, knowledge bases, and HR tools.
Wiz disclosed the issue to Base44 and Wix on July 9, 2025; the fix was implemented within 24 hours and independently verified by Wiz.
Wix reported no evidence of past exploitation or customer impact; it said its investigation was ongoing.
No customer action is required because the fix was applied platform-wide. Wiz recommended reviewing application analytics for unusual visits or registrations during the vulnerable period.

Article Details

Attack Vectors: Unauthenticated registration and OTP-verification endpoints allowed an attacker to create and verify an account for a private Base44 application using its publicly visible app_id, bypassing SSO-only access controls.
Defensive Notes: Base44/Wix fixed the registration flaw by validating application privacy settings before allowing registration; Wiz Research independently verified the fix.
Wix reported no evidence of exploitation or customer compromise. The article recommends reviewing application analytics for unusual visits or registrations during the vulnerable period and monitoring third-party platform access.