CVE-2026-53928: NocoDB Auth Bypass Vulnerability

CVE-2026-53928 Overview

CVE-2026-53928 is a session management vulnerability in NocoDB, an open-source platform for building databases as spreadsheets. Versions prior to 2026.05.1 fail to invalidate refresh tokens during the password-forgot flow. The passwordForgot handler rotates token_version and revokes OAuth tokens but does not call UserRefreshToken.deleteAllUserToken(user.id). An attacker holding a previously captured refresh cookie can exchange it for a fresh JSON Web Token (JWT) even after the victim completes account recovery. The issue is tracked as [CWE-613: Insufficient Session Expiration].

Critical Impact
Attackers with a stolen refresh token retain account access after the victim resets their password, defeating the primary purpose of the recovery flow.

Affected Products

NocoDB versions prior to 2026.05.1

Discovery Timeline

2026-06-23 - CVE-2026-53928 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53928

Vulnerability Analysis

NocoDB issues short-lived access tokens (JWTs) paired with longer-lived refresh tokens stored in cookies. The refresh endpoint validates the cookie and mints new access tokens on demand. The platform implements three separate account-state flows: passwordChange, passwordReset, and passwordForgot. Only the first two purge stored refresh tokens from the database.

The passwordForgot flow performs partial session cleanup. It increments the user's token_version field and revokes OAuth grants, but omits the call to UserRefreshToken.deleteAllUserToken(user.id). As a result, refresh token records issued before the recovery event remain valid in the backing store. A captured cookie continues to satisfy server-side validation and can be exchanged for new JWTs after the password change completes.

Exploitation requires the attacker to first obtain a victim's refresh cookie through prior compromise such as cross-site scripting, network interception, or device theft. The attacker then waits for or observes the password recovery flow and continues issuing refresh requests against the NocoDB API. Each successful refresh produces a usable access token bound to the new password state.

Root Cause

The root cause is incomplete state cleanup across parallel account recovery code paths. The passwordForgot handler does not enforce the same token revocation contract as passwordChange and passwordReset, leaving persistent refresh material associated with a compromised authentication state.

Attack Vector

The attack vector is network-based and requires no user interaction beyond the victim triggering recovery. The attacker must already possess a stolen refresh cookie. The vulnerability is documented in the NocoDB GitHub Security Advisory GHSA-r989-7g3j-wjhw.

Detection Methods for CVE-2026-53928

Indicators of Compromise

Successful /auth/token/refresh requests originating from IP addresses or user agents that differ from the user's recent authenticated sessions.
New JWTs minted for an account within minutes after a passwordForgot event completes.
Concurrent active sessions for the same user account spanning the password reset boundary.

Detection Strategies

Correlate password recovery events with subsequent refresh token usage and flag any refresh activity tied to pre-reset cookies.
Audit NocoDB application logs for refresh token reuse patterns across distinct client fingerprints for the same user identifier.
Implement anomaly detection on JWT issuance volume per account, alerting when refresh frequency spikes after account recovery.

Monitoring Recommendations

Forward NocoDB authentication and refresh endpoint logs to a centralized logging platform for retention and correlation.
Track the token_version field in the user table and alert when refresh tokens with stale versions are accepted.
Monitor outbound API activity from NocoDB service accounts for data exfiltration following password reset events.

How to Mitigate CVE-2026-53928

Immediate Actions Required

Upgrade NocoDB to version 2026.05.1 or later, which adds the missing refresh token deletion call to the passwordForgot flow.
Force a global session invalidation for all users by clearing the refresh token store after upgrading.
Require all users who recently completed a password recovery to re-authenticate from all devices.

Patch Information

The vulnerability is fixed in NocoDB 2026.05.1. The patch adds UserRefreshToken.deleteAllUserToken(user.id) to the passwordForgot handler so that refresh tokens are revoked alongside token_version rotation. Patch details are published in the NocoDB GitHub Security Advisory.

Workarounds

Shorten refresh token lifetime in NocoDB configuration to reduce the exposure window for captured cookies.
Manually purge entries from the nc_user_refresh_tokens table after any user-initiated password recovery until the upgrade is applied.
Enforce HTTPS-only and HttpOnly cookie attributes to limit the avenues by which refresh tokens can be captured.

bash

# Configuration example: verify NocoDB version and rotate refresh tokens post-upgrade
docker pull nocodb/nocodb:2026.05.1
docker compose up -d

# Optional manual revocation via database client
# DELETE FROM nc_user_refresh_tokens WHERE fk_user_id = '<user_id>';