CVE-2026-126287

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.06.2

Description A race condition exists in the oauth-token.service.ts file. This issue occurs during non-atomic rotation, allowing an attacker who has captured a refresh token to present it concurrently with the legitimate client. By doing so, the attacker can obtain their own access and refresh tokens, maintaining scoped access to the system without triggering the reuse detection mechanism.

Recommendations Update NocoDB to version 2026.06.2 or later.