CVE-2026-126280: NocoDB before 2026.08.0 Refresh Token Reuse via Non-Atomic Rotation
NocoDB before 2026.08.0 contains a race condition in refresh-token rotation that allows attackers to reuse tokens because UserRefreshToken.ts never checks the affected-row count. Attackers holding a captured refresh token can present it concurrently with the legitimate user to obtain a valid authenticated session, and no reuse event is recorded.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NocoDBto a version that resolves this vulnerability.Fixed in 2026.08.0
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must possess a captured NocoDB refresh token and submit it concurrently with the legitimate user's refresh-token request. No existing account privileges or user interaction are required.
What is the impact of successful exploitation?
An attacker can obtain a valid authenticated session by reusing the captured refresh token during the race condition. The reuse does not generate a reuse event, reducing the chance of detection through that mechanism.
Which versions are affected?
NocoDB versions before 2026.08.0 are affected. Updating to 2026.08.0 or later addresses the described non-atomic refresh-token rotation behavior.