A private Base44 app could be joined with only its public app id

Symptom

The app was set to private, including SSO-only, and a registration still succeeded for someone who only knew the app id from the address bar.

Root cause

Wiz Research's July 29, 2025 writeup says it reported this to Base44 on July 9, 2025. Registration and one-time-code verification for an app did not require an existing session. The only value they needed was the app id, and that id is not a secret: it is in the app's address and in its manifest path. Wiz says that created a verified user on private apps and bypassed the SSO those apps were set to require. The same page distinguishes three access modes: public login, which allows signup; private with beta authentication, which still allows self-signup; and private with SSO, which is the only setting that restricts access to invited users. Wiz says a platform-wide fix landed in less than 24 hours, and that on July 10 external users could no longer register for private apps. The timeline says that on July 13 the issue was confirmed resolved, with no indication of compromise across the Base44 user base. Base44's statement on that page says that, so far, they had found no evidence a customer was impacted, and that the investigation was still ongoing. Wiz says customers do not have a patch to apply. It does say to review the data and analytics section of your own private apps for unusual visits and registrations on July 9, 2025 and earlier.

This was a Base44 platform bug, not a change to make in this app's code. Do not call registration or verification endpoints, and do not try this against any app other than the one in this project.

In this project only:

1. Open the app access setting. If this app is supposed to be private, it needs the private SSO option. Private with beta authentication still allows self-signup, according to the Wiz writeup.
2. Do not treat the app id in the address or the manifest as a secret.
3. Tell me where in the Base44 dashboard to open Data, then Analytics, so I can look for registrations I do not recognize on or before July 9, 2025.
4. Stop. Do not add users, and do not change unrelated files.

Paste this into the coding tool that has your own project open.

2-minute self-check

These steps are for an app you own. Do not run them against someone else's project.

1. In your own Base44 app, open the access setting and write down whether it is public, private with beta authentication, or private with SSO.
2. In that same app, open Data, then Analytics. Look for user visits and registrations on or before July 9, 2025 that you do not recognize.
3. Do not attempt to register an account on an app you do not own.

Sources

• Wiz: Critical vulnerability in Base44 (July 29, 2025)