CVE-2026-126287: NocoDB before 2026.06.2 OAuth Refresh Token Rotation Race Condition
NocoDB before 2026.06.2 contains a race condition vulnerability in oauth-token.service.ts that allows attackers to reuse a refresh token by presenting it concurrently during non-atomic rotation. Attackers holding a captured refresh token can race the legitimate client to obtain their own access and refresh tokens, retaining scoped access without triggering reuse detection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.06.2
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must possess a captured OAuth refresh token and be able to submit it concurrently with the legitimate client during refresh-token rotation. Exploitation depends on winning the non-atomic rotation race.
Which deployments are affected?
NocoDB versions before 2026.06.2 are affected. The provided information does not identify any configuration prerequisite beyond use of the OAuth refresh-token rotation functionality.
What is the impact if the race is won?
An attacker can obtain their own access token and refresh token from the captured refresh token. This can let them retain the token's scoped access without triggering refresh-token reuse detection.