CVE-2026-24768: NocoDB Unvalidated Redirect Vulnerability in Login Flow
Summary
CVE-2026-24768: NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter. Affects nocodb versions < 0.301.0. Fixed in 0.301.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NocoDB is an open-source platform that transforms databases into smart spreadsheets, enabling users to manage data easily. It provides features for collaboration, data visualization, and integration with various data sources. However, it is susceptible to an unvalidated redirect vulnerability that can be exploited during the login process.
Vulnerability Detail
An unvalidated redirect vulnerability exists in NocoDB's login flow due to insufficient validation of the 'continueAfterSignIn' parameter. This flaw allows attackers to redirect authenticated users to arbitrary external websites after login, facilitating phishing attacks. The vulnerability arises from a permissive URL check that does not enforce restrictions on the destination's origin, domain, or protocol. The redirect logic uses a regular expression that matches any HTTP(S) URL and protocol-relative URLs, leading to potential credential theft through social engineering.
How To Fix
Latest published version: 0.301.3 as of 22 Oct 2026
npm install nocodb@0.301.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.301.0
This is the first release that contains the fix.
npm install nocodb@0.301.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the 'continueAfterSignIn' parameter in login URLs until the package is updated. This will prevent any potential redirects to untrusted sites.
Conclusion
The unvalidated redirect vulnerability in NocoDB's login flow poses a significant risk of phishing attacks. It is crucial for users to update to the latest version to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for nocodb →
FAQ
The vulnerability is an unvalidated redirect that allows attackers to redirect users to malicious sites after they log in.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application.
The vulnerability can lead to phishing attacks, where users may unknowingly submit their credentials to malicious sites.
Yes, a patch is available in version 0.301.0 of NocoDB. Updating to this version will resolve the issue.
If you cannot update immediately, refrain from using the 'continueAfterSignIn' parameter in your login URLs as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
