CVE-2026-28396: NocoDB Refresh Tokens Not Revoked on Password Reset

Background

NocoDB is an open-source platform that transforms your database into a smart spreadsheet interface, allowing users to manage and visualize their data easily. It provides features such as data collaboration, API generation, and integration with various databases. However, a vulnerability has been identified in its password reset functionality, which does not revoke existing refresh tokens, posing a security risk.

Vulnerability Detail

The vulnerability arises from the password reset flow in NocoDB, specifically in the passwordReset() function located in users.service.ts. While this function updates the token_version to invalidate existing JWTs, it fails to call UserRefreshToken.deleteAllUserToken(), which is responsible for deleting all refresh tokens. As a result, an attacker who has previously stolen a refresh token can continue to mint valid JWTs even after the victim has reset their password. This oversight allows unauthorized access until the stolen token expires, potentially compromising user accounts.

npm install nocodb@0.301.3

Workaround

As a temporary workaround, users can manually revoke all refresh tokens by implementing a function that calls UserRefreshToken.deleteAllUserToken() whenever a password reset occurs. Here is a sample code snippet to illustrate this workaround:

function passwordReset(userId) {
    // Existing password reset logic
    updateTokenVersion(userId);

UserRefreshToken.deleteAllUserToken(userId);

// Ensure all refresh tokens are deleted

}

Conclusion

In summary, the vulnerability in NocoDB related to refresh tokens not being revoked during password resets poses a significant security risk. It is crucial for users to update to the latest version or implement the provided workaround to mitigate this issue and protect user accounts.

See every vulnerability recorded for nocodb →

FAQ