Security brief

Base44 disclosure shows how shared authentication flaws can affect private apps

Wiz reported an account-creation path that bypassed private-application access controls; the vendor fixed it after disclosure.

Published 29 Oct 2026 · Evidence: high

What happened

Wiz’s 2025 Base44 research describes an unauthorized account-creation path involving registration and verification endpoints. A public application identifier was enough to reach private applications through that path, bypassing intended access controls including SSO.

According to Wiz, Base44 and Wix validated the finding, fixed it within a day, and reported no evidence of previous abuse. The research demonstrates potential access; it should not be rewritten as confirmed theft from every customer.

For teams buying hosted development platforms, check whether access restrictions are enforced by every registration and authentication route. A private-app setting is only as strong as the backend paths that can create or verify an account.

Read the original source.

What we know

Affected platform in disclosure
Base44
Remediation
Vendor-reported fix after disclosure

What remains unknown

Open question
The vendor reported no evidence of previous abuse; this brief does not independently establish historical access.

Source references