CVE-2026-126278: NocoDB before 2026.08.1 Password Reset Token Race Condition
NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid reset token to perform multiple password changes by sending concurrent reset requests. Attackers can exploit the window created by slow bcrypt hashing before the token is cleared to overwrite the owner's new password and lock them out.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs a valid password-reset token for the target account. No authenticated application session or user interaction is required once the token is available.
How is the race condition exploited in practice?
An attacker sends concurrent password-reset requests using the same valid token. Because bcrypt hashing delays token clearing, multiple requests can be accepted before the token is invalidated, allowing the attacker to overwrite the password selected by the account owner.
What is the likely impact on an affected account?
An attacker can change the account password after the owner performs a reset, potentially locking the owner out. The provided information describes password overwrite and account lockout; it does not identify additional impacts.
Which deployments are affected?
NocoDB versions before 2026.08.1 are affected. The issue is in the password-reset flow, so deployments where users can obtain and use reset tokens are exposed.