CVE-2026-126276: NocoDB before 2026.08.1 Client Authentication Bypass via OAuth Token Exchange
NocoDB before 2026.08.1 contains an authentication bypass vulnerability in oauth-token.service.ts that treats PKCE as a substitute for confidential client authentication, skipping client secret verification when omitted. Attackers holding a captured authorization code and PKCE verifier can mint access tokens and 60-day refresh tokens for a confidential client without knowing its secret.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs a captured authorization code and the corresponding PKCE verifier. They do not need the confidential client's secret when exchanging those values for tokens.
What credentials can an attacker obtain through exploitation?
An attacker can mint access tokens and refresh tokens for the confidential client. The refresh tokens issued through this path are valid for 60 days.
Which deployments are affected?
NocoDB versions before 2026.08.1 are affected where confidential OAuth clients use the vulnerable token exchange behavior. The provided information does not establish whether this configuration is enabled by default.