Advisory VV-005critical2025-07
Base44: private apps open to anyone with the app_id (Wiz)
Undocumented register and verify-OTP endpoints accepted a non-secret app_id, letting anyone create a verified account on private, SSO-only apps. Patched by Wix within 24 hours.
What it is
Wiz found api/apps/{app_id}/auth/register and api/apps/{app_id}/auth/verify-otp exposed without authentication. The app_id was visible in the app URL and in manifests/{app_id}/manifest.json.
Wiz confirmed the bypass across several enterprise apps (internal chatbots, knowledge bases, PII & HR). Wix patched it server-side within 24 hours and found no evidence of exploitation; customers did not need to act.
How to check
- No action is required for this specific bug (server-side fix).
- General lesson: treat IDs in URLs as public. Make sure every endpoint enforces your app’s privacy settings server-side.
How to fix
- Fixed by Base44/Wix. For your own APIs: authorize on the server for every request, never rely on an ID being hard to guess.
// Anti-pattern: "secret" IDs as access control
app.post('/api/apps/:appId/register', register); // anyone who sees appId can call this
// Pattern: check the app's policy server-side before doing anything
app.post('/api/apps/:appId/register', async (req, res) => {
const appCfg = await getApp(req.params.appId);
if (appCfg.private || !appCfg.signupEnabled) return res.status(403).end();
return register(req, res);
});