PT-2026-46998 · Git+2 · Nocodb
CVSS v4.0
6.3
Medium
| Vector | AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
NocoDB versions prior to 2026.04.1
Description
A timing difference exists in the sign-in response when using known versus unknown email addresses. This occurs because the unknown-user branch in the
auth.service.ts file returns a response without performing a password hash comparison. A network-positioned attacker can exploit this by sending unauthenticated sign-in requests to enumerate registered email addresses. To address this, the system now performs a bcrypt.compare (a function used to securely compare a plain-text password with a hashed version) against a dummy hash for unknown users to ensure response times are consistent.Recommendations
Update to version 2026.04.1.
Exploit
Fix
Improper Restriction of Excessive Authentication Attempts
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Nocodb