{"id":"CVE-2026-28396","aliases":["GHSA-x4vh-j75g-268g"],"title":"NocoDB's Refresh Tokens Not Revoked on Password Reset","summary":"NocoDB's Refresh Tokens Not Revoked on Password Reset","severity":"medium","cwe":["CWE-613"],"vendor":"nocodb","product":"nocodb","ecosystem":"npm","affected":["nocodb <= 0.301.2"],"patched":["nocodb 0.301.3"],"published":"2026-03-02","updated":"2026-11-05","sourceUpdated":"2026-11-05T22:53:53Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-x4vh-j75g-268g","references":[{"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-x4vh-j75g-268g"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28396"},{"url":"https://github.com/nocodb/nocodb/releases/tag/0.301.3"},{"url":"https://github.com/nocodb/nocodb/commit/dfbe836577354ba780563a5cf8cb50bfc61a203e"},{"url":"https://github.com/advisories/GHSA-x4vh-j75g-268g"}],"tags":["ghsa","npm"],"epss":0.0021,"epssPercentile":0.11342,"ingestedAt":"2026-11-05T23:41:31.931Z","slug":"CVE-2026-28396","body":"## Overview\n\n### Summary\nThe password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password.\n\n### Details\n`passwordReset()` in `users.service.ts` updated `token_version` (invalidating JWTs) but did not call `UserRefreshToken.deleteAllUserToken()`. The `refreshToken()` method only checked token existence, not `token_version`. Both `passwordChange()` and `signOut()` correctly deleted all refresh tokens.\n\n### Impact\nAn attacker who previously obtained a refresh token retains access after password reset until the token expires.\n\n### Credit\nThis issue was reported by [@bugbunny-research](https://github.com/bugbunny-research) (bugbunny.ai).\n\n## Affected packages\n\n- `nocodb <= 0.301.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `nocodb 0.301.3`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}