Base44: private apps open to anyone with the app_id (Wiz)

What it is

Wiz found api/apps/{app_id}/auth/register and api/apps/{app_id}/auth/verify-otp exposed without authentication. The app_id was visible in the app URL and in manifests/{app_id}/manifest.json.

Wiz confirmed the bypass across several enterprise apps (internal chatbots, knowledge bases, PII & HR). Wix patched it server-side within 24 hours and found no evidence of exploitation; customers did not need to act.

How to check

1. No action is required for this specific bug (server-side fix).
2. General lesson: treat IDs in URLs as public. Make sure every endpoint enforces your app’s privacy settings server-side.

How to fix

1. Fixed by Base44/Wix. For your own APIs: authorize on the server for every request, never rely on an ID being hard to guess.

// Anti-pattern: "secret" IDs as access control
app.post('/api/apps/:appId/register', register); // anyone who sees appId can call this

// Pattern: check the app's policy server-side before doing anything
app.post('/api/apps/:appId/register', async (req, res) => {
  const appCfg = await getApp(req.params.appId);
  if (appCfg.private || !appCfg.signupEnabled) return res.status(403).end();
  return register(req, res);
});

Sources

• Wiz: Critical Vulnerability in AI Vibe Coding platform Base44 ↗
• SecurityWeek: Flaw in Base44 exposed private enterprise apps ↗
• The Hacker News: Wiz uncovers access bypass flaw in Base44 ↗