PT-2026-50474

CVE-2026-53928

Published

2026-06-17

Updated

2026-06-25

Description by

CVSS 4.0

6.3

Medium

MetricsAV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.05.1

Description A stolen refresh token persists after a password-forgot flow, allowing it to be used to generate new JSON Web Tokens (JWTs) even after a user resets their password. While the passwordChange() and passwordReset() functions delete user refresh tokens, the passwordForgot() function only rotates the token version variable and revokes OAuth tokens, failing to call UserRefreshToken.deleteAllUserToken(user.id). Consequently, an attacker with a captured refresh cookie can exchange it for a new access token after the victim completes the recovery process, leading to persistent unauthorized access.

Recommendations Update to version 2026.05.1.

Exploitability

Exploit

Fix

Impacts

Researchers

Bugbunny-Research

Vendors

Affected products

Weakness enumeration

CWE-613: Insufficient Session Expiration

Related identifiers