CVE-2026-53928: NocoDB Refresh Tokens Persist Through Password Recovery Vulnerability
Summary
CVE-2026-53928: NocoDB: Refresh Tokens Persist Through Password Recovery. Affects nocodb versions < 0.301.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NocoDB is an open-source platform that transforms databases into smart APIs, enabling users to create applications without extensive coding knowledge. It offers features such as data visualization, collaboration tools, and integration capabilities. However, a significant vulnerability has been identified that affects the security of user sessions during the password recovery process.
Vulnerability Detail
The vulnerability arises from the handling of refresh tokens during the password recovery flow. Specifically, while the processes for changing and resetting passwords correctly delete the user's refresh tokens, the password forgot process only rotates the token version and revokes OAuth tokens without deleting the refresh tokens. This oversight allows an attacker with a stolen refresh token to continue accessing the user's account even after the user has reset their password, leading to persistent unauthorized access.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually revoke all refresh tokens by implementing a function that deletes all user tokens when a password recovery is initiated. Here is a sample code snippet to illustrate this:
function revokeRefreshTokens(userId) {
UserRefreshToken.deleteAllUserToken(userId);
}
// Call this function during the password forgot process.
revokeRefreshTokens(user.id);
Conclusion
The CVE-2026-53928 vulnerability in NocoDB highlights a critical flaw in the password recovery process that can lead to unauthorized access. It is essential for users to update to the latest version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for nocodb →
FAQ
The vulnerability allows an attacker to maintain unauthorized access to a user's account even after the user has reset their password, leading to potential data breaches.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. You can access the Vulert playground without signup at Vulert Scanner.
If an immediate update is not possible, implement the provided workaround to revoke refresh tokens during the password recovery process.
A refresh token is a credential used to obtain a new access token without requiring the user to re-authenticate, thus maintaining a session.
The CVSS score of this vulnerability is 6.3, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
