CVE-2026-53926: NocoDB: OAuth Tokens Persist Through Security Events
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, revokeAllOAuthTokensByUser in the users service is an empty stub being called from passwordChange, passwordForgot, and passwordReset. OAuth access and refresh tokens were not revoked when the user changed, reset, or recovered their password, leaving an attacker-issued OAuth grant valid after the user believed they had locked the attacker out. This vulnerability is fixed in 2026.05.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NocoDBto a version that resolves this vulnerability.Fixed in 2026.05.1 - Compensating control
Revoke any existing OAuth access and refresh tokens for affected users (e.g., tokens issued before upgrading to 2026.05.1), since tokens were not revoked on password change/reset/recovery prior to 2026.05.1.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53926?
The severity of CVE-2026-53926 is medium with a CVSS score of 6.3.
What type of tokens are affected by CVE-2026-53926?
CVE-2026-53926 affects OAuth access and refresh tokens.
How do I fix CVE-2026-53926?
To fix CVE-2026-53926, update NocoDB to version 2026.05.1 or later.
What issues does CVE-2026-53926 present?
CVE-2026-53926 allows OAuth tokens to persist through security events like password changes, resets, or recovery.
Is CVE-2026-53926 exploitable remotely?
Yes, CVE-2026-53926 can be exploited remotely due to the nature of OAuth tokens.