A Base44 login could hand the account token to another site

Symptom

Signing in on Base44 could send the account token to a site you did not mean to visit, or into an app built on the platform.

Root cause

Imperva's August 27, 2025 writeup describes three platform flaws it reported in March 2025. The login flow did not limit the next address to a trusted site, and the access token was added to that redirect, so a different site could receive the session. A first fix only checked that the address started with the platform's own host, which still allowed a lookalike host; Imperva says a later fix checked the full redirect address. Separately, a preview of a user-built app ran on the platform's own site, and editing that app's code was enforced only in the browser, so script in the app ran where the account session was stored. The same writeup says the JWT for the main Base44 account was passed into a user-built app in the URL, and that those apps can run their own script, so the token could be read and used for the whole account, not just that app. The timeline says partial fixes, including the cross-site scripting issue and a tighter redirect check, landed in March 2025, more fixes were in progress in April, and the August post is the public disclosure.

Do not construct a login link, and do not add script to this app. This was fixed on the Base44 platform. In this project only:

1. Tell me to sign in from the Base44 app itself, not from a link that continues to some other site after login.
2. Search this project's code for a place that reads an account token, access token, or JWT from the page URL, from local storage of the platform site, or from a query parameter. List the file names. Do not print any token value.
3. If you find that read, remove it. Do not send the token to another host, and do not log it.
4. Stop so I can review the diff.

Paste this into the coding tool that has your own project open.

2-minute self-check

These steps are for an app you own. Do not run them against someone else's project.

1. Sign in to your own Base44 account from the platform's own login page. Do not use a link that sends you to a different site after login.
2. In your own account, look through the apps and members. Remove any you do not recognize.
3. In your own app's code, search for a read of a token from the page URL. If a token was copied out of a login URL into a note or a chat, delete that copy and sign out of the Base44 session. Do not paste the token anywhere else.

Sources

• Imperva: Critical flaws in Base44 (August 27, 2025)