CVE-2026-53926

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.05.1

Description OAuth access and refresh tokens are not revoked when a user changes, resets, or recovers their password. This occurs because the revokeAllOAuthTokensByUser() function in the users service was an empty stub called by passwordChange(), passwordForgot(), and passwordReset(). Consequently, an attacker-issued OAuth grant remains valid even after a user performs these security actions to lock out unauthorized parties, allowing persistent unauthorized access.

Recommendations Update to version 2026.05.1.