GitHub Advisoryadvisory · npm
GHSA-x4vh-j75g-268g NocoDB's Refresh Tokens Not Revoked on Password Reset
MEDIUM
Official page ↗
- Aliases
- CVE-2026-28396
- Ecosystem
- npm
- Packages
- nocodb
- Severity
- Moderate
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
- Weaknesses
- CWE-613
- Reviewed
- 2026-03-02
Affected packages
• npm nocodb: < 0.301.3 → fixed in 0.301.3
Description
Summary
The password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password.
Details
`passwordReset()` in `users.service.ts` updated `token_version` (invalidating JWTs) but did not call `UserRefreshToken.deleteAllUserToken()`. The `refreshToken()` method only checked token existence, not `token_version`. Both `passwordChange()` and `signOut()` correctly deleted all refresh tokens.
Impact
An attacker who previously obtained a refresh token retains access after password reset until the token expires.
Credit
This issue was reported by @bugbunny-research (bugbunny.ai).
Related
Weakness · not in database (1)
Alias · CVE (1)
- CVE-2026-28396 NocoDB is software for building databases as spreadsheets. vulnerability