CVE-2026-126280

NocoDB refresh token reuse in non-atomic rotation

critical · 9.1

Fix listed

NocoDB

Published Nov 13, 2026, 09:36 UTC

Description

NocoDB before 2026.08.0 contains a race condition in refresh-token rotation that allows attackers to reuse tokens because UserRefreshToken.ts never checks the affected-row count. Attackers holding a captured refresh token can present it concurrently with the legitimate user to obtain a valid authenticated session, and no reuse event is recorded.

Reported fixed versions

2026.08.0

Official CVE record View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.