GHSA-MQHR-6J6H-74P5 Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak

Summary Budibase attaches a REST datasource's stored credentials Bearer/Basic tokens and static headers to an outgoing request before it decides which host the request goes to, and never checks that the destination host matches the datasource. A query's request path can be pointed at any host via...