CVE-2026-47386: NocoDB OAuth Authorization Code Race Condition Vulnerability
Summary
CVE-2026-47386: NocoDB: OAuth Authorization Code Race Condition. Affects nocodb versions < 2026.05.1. Fixed in 2026.05.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NocoDB is an open-source no-code platform that transforms databases into smart APIs. It allows users to build applications without extensive coding knowledge, leveraging existing database structures. However, it has a vulnerability related to OAuth authorization codes, which can lead to security issues if not addressed.
Vulnerability Detail
The vulnerability arises from a race condition in the token-exchange process of OAuth authorization codes. When two concurrent requests attempt to exchange the same authorization code for tokens, both can succeed, resulting in multiple valid access and refresh tokens being issued. This undermines the single-use guarantee of the PKCE (Proof Key for Code Exchange) mechanism, potentially allowing an attacker to obtain a long-lived refresh token by exploiting this flaw. The issue is rooted in the way the token-exchange flow updates the state of the authorization code, allowing for concurrent updates that should not be permitted.
How To Fix
Latest published version: 0.301.3 as of 22 Oct 2026
npm install nocodb@0.301.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.05.1
This is the first release that contains the fix.
npm install nocodb@2026.05.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your application does not allow concurrent token-exchange requests using the same authorization code. Implementing a locking mechanism or queuing requests can help mitigate the risk until the package is updated.
Conclusion
The CVE-2026-47386 vulnerability in NocoDB poses a significant risk due to a race condition in the OAuth token-exchange process. It is essential to update to the patched version to secure your application and prevent unauthorized access. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for nocodb →
FAQ
CVE-2026-47386 is a vulnerability in NocoDB that allows multiple valid tokens to be issued from the same OAuth authorization code due to a race condition.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json.
An attacker could exploit this vulnerability to obtain unauthorized access tokens, leading to potential data breaches and unauthorized actions within your application.
Yes, a patch is available in version 2026.05.1 of NocoDB. It is recommended to update to this version to mitigate the vulnerability.
PKCE (Proof Key for Code Exchange) is an extension to OAuth 2.0 that enhances security for public clients by preventing authorization code interception attacks. It is crucial for maintaining the integrity of the authorization process.
References
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
