CVE-2026-126276

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.08.1

Description An authentication bypass exists in oauth-token.service.ts where Proof Key for Code Exchange (PKCE) is incorrectly treated as a substitute for confidential client authentication. This causes the system to skip client secret verification when the secret is omitted. An attacker who has captured an authorization code and the PKCE verifier can generate access tokens and 60-day refresh tokens for a confidential client without possessing the required client secret.

Recommendations Update NocoDB to version 2026.08.1 or later.