PT-2026-47084 · Npm · Nocodb

Published

2026-06-05

·

Updated

2026-06-05

·

CVE-2026-47386

CVSS v4.0

6.3

Medium

VectorAV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Summary

Two concurrent token-exchange requests using the same OAuth authorization code could each mint a distinct valid (access token, refresh token) pair, breaking the single-use guarantee that PKCE relies on.

Details

The token-exchange flow read is used and called markAsUsed as an unconditional update at the end of the path. A new OAuthAuthorizationCode.claimByCode method now performs an atomic compare-and-swap (WHERE code = ? AND is used = false) and is called immediately before OAuthToken.insert, after redirect-URI, PKCE, and client authentication have all succeeded. Only the first concurrent caller's UPDATE wins; the rest see invalid grant: Authorization code has already been used.

Impact

An attacker who has observed an authorization code and the corresponding PKCE verifier (for example through a malicious OAuth-aware client or by racing a real exchange) could obtain a long-lived refresh token in addition to the legitimate one.

Credit

This issue was reported by @eddieran.

Fix

Race Condition

Weakness Enumeration

Related Identifiers

CVE-2026-47386
GHSA-8M7C-HF24-5G47

Affected Products

Nocodb