CVE-2026-47386 Overview
CVE-2026-47386 is a race condition vulnerability in NocoDB, an open-source platform that turns databases into spreadsheet-style interfaces. Versions prior to 2026.05.1 allow two concurrent token-exchange requests using the same OAuth authorization code to each return a distinct valid (access_token, refresh_token) pair. This behavior breaks the single-use guarantee that Proof Key for Code Exchange (PKCE) relies on. The flaw is tracked under CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization). The vendor addressed the issue in NocoDB 2026.05.1.
Critical Impact
Concurrent OAuth token exchanges can mint duplicate valid token pairs from a single authorization code, undermining PKCE single-use guarantees and enabling potential session duplication.
Affected Products
- NocoDB versions prior to 2026.05.1
- Deployments using OAuth with PKCE for authentication
- Self-hosted NocoDB instances exposing the token endpoint
Discovery Timeline
- 2026-06-23 - CVE-2026-47386 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-47386
Vulnerability Analysis
The vulnerability resides in the OAuth 2.0 token exchange flow used by NocoDB. When a client redeems an authorization code at the token endpoint, the server is expected to invalidate that code atomically after issuing a token pair. In NocoDB versions before 2026.05.1, the code-invalidation step is not atomic with token issuance. An attacker capable of submitting two concurrent token-exchange requests using the same authorization code can receive two independent (access_token, refresh_token) pairs.
This defeats the single-use guarantee that PKCE enforces. PKCE is designed to ensure that even if an authorization code is intercepted, only the original requester possessing the code_verifier can redeem it, and only once. Duplicate token issuance breaks downstream assumptions around session uniqueness, revocation, and refresh-token rotation.
Root Cause
The root cause is a Time-of-Check Time-of-Use (TOCTOU) flaw [CWE-362]. The code-validation check and the code-consumption write are not protected by a transactional lock or atomic compare-and-swap. Concurrent requests pass the validity check before either has marked the code as consumed.
Attack Vector
Exploitation requires network access to the NocoDB token endpoint and possession of a valid authorization code together with its PKCE code_verifier. The attacker submits two or more parallel HTTP requests to the token endpoint with identical parameters. Because exploitation depends on precise timing and prerequisite access to a valid code, attack complexity is high. No verified public proof-of-concept is currently available. See the GitHub Security Advisory for the vendor's technical description.
Detection Methods for CVE-2026-47386
Indicators of Compromise
- Multiple successful 200 OK responses from /auth/token (or equivalent token endpoint) for the same authorization code parameter within a short time window.
- Two or more distinct access_token or refresh_token values issued to the same client_id and code_verifier pairing.
- Concurrent user sessions originating from disparate IP addresses immediately following a single OAuth login.
Detection Strategies
- Parse NocoDB authentication logs and correlate token-exchange requests by code parameter; flag any code that appears in more than one successful issuance.
- Add server-side instrumentation to record the lifecycle of each authorization code, including issuance, redemption attempts, and invalidation timestamps.
- Monitor for refresh-token families that share the same originating authorization code, which indicates the single-use property was violated.
Monitoring Recommendations
- Forward NocoDB application and reverse-proxy logs to a centralized logging or SIEM platform for retention and correlation.
- Alert on burst patterns of identical POST requests to the OAuth token endpoint arriving within milliseconds of one another.
- Track refresh-token rotation chains and alert when two active chains derive from a single authorization grant.
How to Mitigate CVE-2026-47386
Immediate Actions Required
- Upgrade all NocoDB instances to version 2026.05.1 or later.
- Inventory active OAuth sessions and rotate or revoke refresh tokens issued by vulnerable versions.
- Restrict network exposure of the NocoDB token endpoint to trusted clients where feasible.
Patch Information
The vendor fixed CVE-2026-47386 in NocoDB 2026.05.1. The fix enforces atomic single-use semantics on OAuth authorization codes during token exchange. Refer to the NocoDB GitHub Security Advisory GHSA-8m7c-hf24-5g47 for release notes and patch details.
Workarounds
- Place a rate-limiting reverse proxy in front of the NocoDB token endpoint to reject duplicate concurrent requests sharing the same code parameter.
- Shorten the authorization-code time-to-live (TTL) in deployment configuration to reduce the window for concurrent redemption.
- Audit and revoke long-lived refresh tokens issued before the upgrade to invalidate any duplicate token pairs already minted.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
