Sign In
Advisories

NocoDB before 2026.08.0 Refresh Token Reuse via Non-Atomic Rotation

Go back
Severity
critical
Date
Affecting

  • nocodb >= 0, < 2026.08.0

CWE
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSS
9.1
CVSS V4 Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Credit
komyunghan
Description
NocoDB before 2026.08.0 contains a race condition in refresh-token rotation that allows attackers to reuse tokens because UserRefreshToken.ts never checks the affected-row count. Attackers holding a captured refresh token can present it concurrently with the legitimate user to obtain a valid authenticated session, and no reuse event is recorded.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.
  • Vulnerability Prioritization
    Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
  • Early Warning System
    Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.
Schedule a Demo