Budibase builds internal applications from data sources and UI components. Some deployments are meant for a small team, while others expose a tenant login page or an app-specific portal. A product title can find candidate hosts, but it cannot show which applications are published and which identities can enter them.
Budibase supports authentication and SSO, including OIDC. Enforced SSO makes the configured identity provider mandatory for users and disables existing password login after it is enabled. The documentation also describes a maintenance mode for an identity-provider lockout. Those controls need a tested recovery path because the same setting that removes weak passwords can block administrators.
What the probe observed
The count-only ZoomEye probe ran on 2026-10-30 at about 17:46 UTC with sub_type=all, page 1, and a page size of one. app="Budibase" returned 3,675. title="Budibase" returned 3,986.
The values are close but not identical because the fingerprints use different fields. Neither count proves that an application is public or that password login is enabled. A Budibase deployment can use a custom domain and hide the product title, and an application can require a tenant-specific login page.
Use the results to identify organizational hosts and then verify the login path, tenant URL, identity provider, application list, and published access level. Do not attempt to access a tenant or application you do not own.
Review published apps and identity mapping
For a confirmed deployment, inventory users, groups, application access, SSO configuration, and any password accounts. Test a user from the intended identity provider and a user without access. Verify that group or role claims map to the correct application role and that removing a group in the identity provider removes access after the expected session lifetime.
Check the base connection credentials as a separate boundary. An app user who can read a screen should not automatically receive the database administrator secret installed in the Budibase data source. Use a dedicated integration account and restrict its database permissions.
Test enforced SSO in a staging environment with a break-glass identity and the documented maintenance process. A failed identity-provider configuration should not leave every administrator locked out.
The discovery count locates candidate portals. The access decision depends on the published application, the identity mapping, and the data-source credential behind it.