GHSA-g72g-r7m4-9x4g CVE-2026-53926
NocoDB: OAuth Tokens Persist Through Security Events
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.41%
- Chance of exploitation in the next 30 days. Higher than 34.83% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-613 Insufficient Session Expiration
- Fix
2026.05.1- Upgrade nocodb to this version or later
Description
Summary
OAuth access and refresh tokens were not revoked when the user changed, reset, or recovered their password, leaving an attacker-issued OAuth grant valid after the user believed they had locked the attacker out.
Details
revokeAllOAuthTokensByUser in the users service was an empty stub being called from
passwordChange, passwordForgot, and passwordReset. It now delegates to
OAuthToken.revokeAllByUser(userId), which deletes the rows and invalidates the
related auth caches. All three reset/recovery flows now consistently revoke refresh
tokens (GHSA-r989-7g3j-wjhw), OAuth tokens (this advisory), and rotate
token_version.
Impact
Persistent unauthorized access through previously issued OAuth tokens after a documented security event (password change, forgot, or reset).
Credit
This issue was reported by @bugbunny-research.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| nocodb | < 2026.05.1 |
2026.05.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
nocodb npm → 2026.05.1
- npm
npm install nocodb@2026.05.1- yarn
yarn add nocodb@2026.05.1- pnpm
pnpm add nocodb@2026.05.1
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-613: Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
How to prevent it
- Implementation: Set sessions/credentials expiration date.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-hmcr-rmjq-47qr NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint | Medium | Also affects nocodb |
| GHSA-h6vv-pcq8-7xm4 NocoDB: Server-Side Request Forgery via Base Migration URL | Medium | Also affects nocodb |
| GHSA-6mhr-74x2-98v9 NocoDB: Stored Cross-Site Scripting via Secure Attachment | Medium | Also affects nocodb |
| GHSA-r989-7g3j-wjhw NocoDB: Refresh Tokens Persist Through Password Recovery | Medium | Also affects nocodb |
| GHSA-gprh-27j3-g5h4 NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL | Medium | Also affects nocodb |
| GHSA-xxpj-q764-9r6q NocoDB: Missing Ownership Check in MCP Attachment Read | Low | Also affects nocodb |
| GHSA-hj85-ph9q-78jg NocoDB: Stored Cross-Site Scripting via Form View Redirect URL | High | Also affects nocodb |
| GHSA-8m7c-hf24-5g47 NocoDB: OAuth Authorization Code Race Condition | Medium | Also affects nocodb |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor