GHSA-gh4h-34gr-87r7: Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders

When an SSO-authenticated user tests an automation in the Budibase builder, their OAuth2 access token and refresh token are included in the automation test results. These results are broadcast via WebSocket to all builders connected to the same dev app and stored in an in-memory cache accessible to any builder who polls the test status endpoint. This allows any co-builder of the same app to steal the testing user’s OAuth2 tokens.