PT-2026-50474 · Nocodb · Nocodb

Bugbunny-Research · Published 2026-06-17 · Updated 2026-06-23 · CVE-2026-53928

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.05.1

Description A stolen refresh token persists after a password-forgot flow, allowing it to be used to generate new JSON Web Tokens (JWTs) even after a user resets their password. While the passwordChange() and passwordReset() functions delete user refresh tokens, the passwordForgot() function only rotates the token version variable and revokes OAuth tokens, failing to call UserRefreshToken.deleteAllUserToken(user.id). Consequently, an attacker with a captured refresh cookie can exchange it for a new access token after the victim completes the recovery process, leading to persistent unauthorized access.

Recommendations Update to version 2026.05.1.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-53928

GHSA-R989-7G3J-WJHW

Affected Products

Nocodb

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-53928 · Security Note
• https://osv.dev/vulnerability/GHSA-r989-7g3j-wjhw · Vendor Advisory
• https://github.com/nocodb/nocodb/security/advisories/GHSA-r989-7g3j-wjhw · Note
• https://github.com/nocodb/nocodb · Note