CVE-2026-28396: NocoDB: Refresh Tokens Not Revoked on Password Reset
Summary The password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password.
Details passwordReset() in users.service.ts updated tokenversion (invalidating JWTs) but did not call UserRefreshToken.deleteAllUserToken(). The refreshToken() method only checked token existence, not tokenversion. Both passwordChange() and signOut() correctly deleted all refresh tokens.
Impact An attacker who previously obtained a refresh token retains access after password reset until the token expires.
Credit This issue was reported by @bugbunny-research (bugbunny.ai).
Other sources
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password. This issue has been patched in version 0.301.3.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28396?
CVE-2026-28396 has a medium severity rating due to the potential for unauthorized access via unrevoked refresh tokens after a password reset.
How do I fix CVE-2026-28396?
To fix CVE-2026-28396, upgrade to NocoDB version 0.301.3 or later to ensure refresh tokens are revoked during password resets.
What types of systems are affected by CVE-2026-28396?
CVE-2026-28396 affects NocoDB versions up to and including 0.301.2.
What impact does CVE-2026-28396 have on user accounts?
CVE-2026-28396 allows attackers with stolen refresh tokens to generate new JWTs and maintain access to user accounts even after a password reset.
Is there a workaround for CVE-2026-28396?
No official workaround exists for CVE-2026-28396; the only resolution is to update to the patched version.