PT-2026-42676 · Nocodb · Nocodb
Published
2026-05-21
·
Updated
2026-05-21
·
CVE-2026-46550
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
NocoDB (affected versions not specified)
Description
The refresh-token cookie is configured with
httpOnly: true but lacks the secure flag and the sameSite attribute. The absence of the secure flag allows the cookie to be intercepted over plain HTTP networks. The missing sameSite attribute enables browsers to attach the cookie to cross-site POST requests, facilitating Cross-Site Request Forgery (CSRF) attacks against the token-refresh endpoint. Specifically, the setTokenCookie() function in packages/nocodb/src/services/users/helpers.ts fails to set these attributes. Consequently, the endpoint 'POST /api/v2/auth/token/refresh' reads the cookie unconditionally and returns a new JSON Web Token (JWT) without requiring a CSRF token. Malicious cross-origin pages could trigger a token refresh and potentially capture the new JWT if combined with other vulnerabilities like cross-site scripting (XSS) or open redirects.Recommendations
Update the
setTokenCookie() function to include sameSite: 'lax' and set the secure flag to true when the request URL starts with HTTPS.
As a temporary workaround, restrict access to the 'POST /api/v2/auth/token/refresh' endpoint to trusted networks or ensure the application is only accessed via HTTPS.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nocodb