A public app id was enough to register an account on a private Base44 app

On July 29, 2025, Wiz Research published its report on Base44, which Wix had acquired. Wiz says a non-secret app id, visible on an app built with the platform, was enough to create a verified account on a private application. That account bypassed the authentication controls Base44 provided, including single sign-on, and opened private apps and the data in them. Wiz calls the issue critical. The post does not give a CVE id or a CVSS score.

Wiz says it reported the vulnerability to Base44 and Wix on July 9, 2025, and that Wix deployed a fix in less than 24 hours. The timeline in the post says Wiz verified on July 10 that outside users could no longer register on private applications, and that on July 13 Wix said the issue was resolved and that it saw no indication of compromise across the Base44 user base. The statement from Base44, part of Wix, quoted in the post says Wix investigated and, so far, found no evidence that any customer was impacted by an attacker using the vulnerability, and that the investigation was ongoing.

Wiz says the fix was applied on the platform, so customers do not have a separate patch to install. The post says an organization can still review the analytics section in a Base44 app for unusual visits and registrations on private apps during the vulnerable period, which it dates as July 9 and earlier.