2026-10-25

The Base44 bug: a public app ID was enough to join private apps

In July 2025, Wiz Research found that the vibe coding platform Base44 left two auth endpoints open: auth/register and auth/verify-otp. With nothing but an app's app_id, which sits right in the URL and the manifest.json path, anyone could create a verified account on private apps, even ones set to SSO only. Wix fixed it server-side in under 24 hours and says it saw no abuse.

Read Wiz's write-up for the details.

The lesson for your app: an ID in the URL is not a secret, and a hidden endpoint is not a locked one. Open a private window, sign up with a fresh email, and check that the server, not the UI, refuses anyone who isn't invited.