CVE-2026-28396Medium▾ SunlitNocoDB's Refresh Tokens Not Revoked on Password Reset
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.2%
The password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password.
passwordReset() in users.service.ts updated token_version (invalidating JWTs) but did not call UserRefreshToken.deleteAllUserToken(). The refreshToken() method only checked token existence, not token_version. Both passwordChange() and signOut() correctly deleted all refresh tokens.
An attacker who previously obtained a refresh token retains access after password reset until the token expires.
This issue was reported by @bugbunny-research (bugbunny.ai).
nocodb <= 0.301.2Upgrade to a patched release:
nocodb 0.301.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-28361MediumNocoDB Missing Ownership Validation in MCP Token Operations
CVE-2026-28399MediumNocoDB Vulnerable to SQL Injection via DATEADD Formula
CVE-2026-28360LowNocoDB has Plaintext Storage of Shared View Passwords
CVE-2026-53928MediumNocoDB: Refresh Tokens Persist Through Password Recovery
CVE-2026-53927MediumNocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL
CVE-2026-53929MediumNocoDB: Stored Cross-Site Scripting via Secure Attachment