CVE-2026-53926: NocoDB Auth Bypass Vulnerability

CVE-2026-53926 Overview

CVE-2026-53926 affects NocoDB, an open-source platform for building databases as spreadsheets. The vulnerability exists in the revokeAllOAuthTokensByUser function within the users service. This function is an empty stub invoked from passwordChange, passwordForgot, and passwordReset workflows. OAuth access and refresh tokens are not revoked when a user changes, resets, or recovers their password. An attacker who previously obtained a valid OAuth grant retains access after the user believed they had revoked it. The issue is tracked as [CWE-613: Insufficient Session Expiration] and is fixed in NocoDB version 2026.05.1.

Critical Impact
Attacker-issued OAuth tokens remain valid after password change, reset, or recovery, defeating the standard account recovery containment workflow.

Affected Products

NocoDB versions prior to 2026.05.1
NocoDB self-hosted deployments using OAuth authentication
NocoDB cloud-hosted instances relying on the affected users service

Discovery Timeline

2026-06-23 - CVE-2026-53926 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53926

Vulnerability Analysis

The vulnerability is a broken session management defect classified under [CWE-613]. NocoDB issues OAuth access tokens and refresh tokens for authenticated sessions. When a user initiates a password change, forgot-password, or password reset flow, the users service is expected to revoke any outstanding OAuth grants tied to that account. Instead, the revokeAllOAuthTokensByUser function is implemented as an empty stub. The callers in passwordChange, passwordForgot, and passwordReset execute the call, return successfully, and update the password without invalidating any tokens. The result is that an attacker holding stolen or attacker-issued OAuth tokens retains authenticated access to the victim account.

Root Cause

The root cause is an unimplemented revocation routine in the users service. The function signature exists and is wired into all three password lifecycle flows, but the body contains no logic to enumerate or invalidate active OAuth access and refresh tokens. Password state changes therefore do not cascade to the OAuth token store.

Attack Vector

An attacker first obtains an OAuth grant for a target account through phishing, token theft, or a compromised client. The victim detects suspicious activity and changes or resets the account password to lock the attacker out. Because the password reset does not revoke OAuth tokens, the attacker continues to use the existing access token, or uses the refresh token to mint new access tokens, until the tokens reach their natural expiration. The attack vector is network-based and requires no further interaction with the victim after the initial token acquisition.

No verified public proof-of-concept code is available. See the GitHub Security Advisory for vendor-provided technical details.

Detection Methods for CVE-2026-53926

Indicators of Compromise

OAuth access or refresh token usage from a session timestamp that predates a recent password change, reset, or recovery event for the same user.
API activity from IP addresses or user agents that differ from the user's post-reset login pattern.
Refresh token exchanges occurring on accounts flagged by users as compromised.

Detection Strategies

Correlate passwordChange, passwordForgot, and passwordReset events with subsequent OAuth token usage for the same user identifier.
Alert on any OAuth access token or refresh token used after a password reset timestamp on the affected NocoDB versions.
Review NocoDB audit logs for sessions that persist across password lifecycle events.

Monitoring Recommendations

Forward NocoDB authentication and OAuth token logs to a central SIEM for correlation with user-reported account recovery events.
Track refresh token reuse and unusually long-lived sessions per account.
Monitor outbound API calls from NocoDB service accounts following any password reset workflow.

How to Mitigate CVE-2026-53926

Immediate Actions Required

Upgrade NocoDB to version 2026.05.1 or later, where revokeAllOAuthTokensByUser is properly implemented.
For any account suspected of compromise, manually invalidate OAuth tokens at the database or identity provider level in addition to resetting the password.
Audit recent password reset events and revoke OAuth grants issued before each reset timestamp.

Patch Information

The vulnerability is fixed in NocoDB 2026.05.1. The fix implements token revocation logic inside revokeAllOAuthTokensByUser, ensuring that calls from passwordChange, passwordForgot, and passwordReset invalidate all outstanding OAuth access and refresh tokens for the user. Refer to the GitHub Security Advisory GHSA-g72g-r7m4-9x4g for upgrade details.

Workarounds

If immediate upgrade is not possible, manually delete OAuth access and refresh token records from the NocoDB token store after any password change, reset, or recovery operation.
Shorten OAuth access token and refresh token lifetimes in the NocoDB configuration to reduce the window of continued attacker access.
Require users to re-authenticate all OAuth clients after a password reset using out-of-band administrative procedures.

bash

# Configuration example: upgrade NocoDB Docker deployment to the patched version
docker pull nocodb/nocodb:2026.05.1
docker stop nocodb && docker rm nocodb
docker run -d --name nocodb -p 8080:8080 \
  -v /var/lib/nocodb:/usr/app/data \
  nocodb/nocodb:2026.05.1