Eddieran

**Name of the Vulnerable Software and Affected Versions** NocoDB versions prior to 2026.05.1 **Description** A flaw in the token-exchange flow allows two concurrent requests using the same OAuth authorization code to each generate a distinct valid `access token` and `refresh token` pair. This occurs because the system previously read the `is used` status and performed the `markAsUsed` update unconditionally at the end of the process, failing the single-use guarantee of PKCE (Proof Key for Code Exchange), a security extension for OAuth 2.0. An attacker who observes an authorization code and the corresponding PKCE verifier could obtain a long-lived refresh token alongside the legitimate user. **Recommendations** Update to version 2026.05.1.