GitHub Advisoryadvisory · npm
GHSA-r989-7g3j-wjhw NocoDB: Refresh Tokens Persist Through Password Recovery
MEDIUM
Official page ↗
- Aliases
- CVE-2026-53928
- Ecosystem
- npm
- Packages
- nocodb
- Severity
- Moderate
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
- Weaknesses
- CWE-613
- Reviewed
- 2026-06-17
Affected packages
• npm nocodb: <= 0.301.3 (no fix yet)
Description
Summary
A stolen refresh token survived a password-forgot flow and could be used to mint fresh
JWTs even after the user reset their password.
Details
`passwordChange` and `passwordReset` deleted the user's refresh tokens, but
`passwordForgot` only rotated `token_version` and revoked OAuth tokens — it did not
call `UserRefreshToken.deleteAllUserToken(user.id)`. An attacker holding a captured
refresh cookie could still exchange it for a new access token after the victim
triggered the recovery flow.
Impact
Persistent unauthorized access after password recovery. Once a refresh token leaks, the
documented "Forgot password" recovery flow did not in fact revoke the attacker's
session.
Credit
This issue was reported by @bugbunny-research.
Related
Weakness · not in database (1)
Alias · CVE (1)
- CVE-2026-53928 NocoDB is software for building databases as spreadsheets. vulnerability