Case base44-auth-bypass-wizModel & data leakIsrael
Wiz finds auth bypass exposing private enterprise apps on Wix's Base44 platform
Wiz Research found undocumented register and verify-otp endpoints that needed only a public app_id to create verified accounts on private Base44 apps, bypassing SSO. Wix fixed it within 24 hours of the 9 July report.
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Jul 29, 2025
- Location
- Israel
- Target
- Base44 (Wix) AI app platform
- Severity
- High
- Triggered by
- Wiz Research
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
Wiz Research found undocumented register and verify-otp endpoints that needed only a public app_id to create verified accounts on private Base44 apps, bypassing SSO. Wix fixed it within 24 hours of the 9 July report.
Impact: Internal chatbots, knowledge bases and HR apps built on Base44 were exposed to unauthorised access
Who triggered it
Actor: Wiz Research
Attribution: Responsible disclosure; no evidence of malicious exploitation
Motive: Security research
How it happened
Attack vector: Unauthenticated API endpoints discovered via exposed Swagger UI; app_id visible in URLs and manifests
Root cause: Authentication endpoints lacked access controls on the platform side
Timeline
- Wiz reports the flaw to Base44 and Wix
- Server-side fix deployed
- Public disclosure
Response
Wix patched server-side; customers needed no action
Current status: Patched
Sources (open in a new tab)
- The Hacker News thehackernews.com
- Infosecurity Magazine infosecurity-magazine.com
- SecurityWeek securityweek.com
Cite this case
Wiz finds auth bypass exposing private enterprise apps on Wix's Base44 platform. AI Threat Watch, case base44-auth-bypass-wiz, Jul 29, 2025. https://aithreat.io/cases/base44-auth-bypass-wiz/
Permanent link: https://aithreat.io/cases/base44-auth-bypass-wiz/