---
id: CVE-2026-28396
aliases:
  - GHSA-x4vh-j75g-268g
title: NocoDB's Refresh Tokens Not Revoked on Password Reset
summary: NocoDB's Refresh Tokens Not Revoked on Password Reset
severity: medium
cwe:
  - CWE-613
vendor: nocodb
product: nocodb
ecosystem: npm
affected:
  - nocodb <= 0.301.2
patched:
  - nocodb 0.301.3
published: '2026-03-02'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T22:53:53Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-x4vh-j75g-268g'
references:
  - url: 'https://github.com/nocodb/nocodb/security/advisories/GHSA-x4vh-j75g-268g'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-28396'
  - url: 'https://github.com/nocodb/nocodb/releases/tag/0.301.3'
  - url: >-
      https://github.com/nocodb/nocodb/commit/dfbe836577354ba780563a5cf8cb50bfc61a203e
  - url: 'https://github.com/advisories/GHSA-x4vh-j75g-268g'
tags:
  - ghsa
  - npm
epss: 0.0021
epssPercentile: 0.11342
ingestedAt: '2026-11-05T23:41:31.931Z'
---

## Overview

### Summary
The password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password.

### Details
`passwordReset()` in `users.service.ts` updated `token_version` (invalidating JWTs) but did not call `UserRefreshToken.deleteAllUserToken()`. The `refreshToken()` method only checked token existence, not `token_version`. Both `passwordChange()` and `signOut()` correctly deleted all refresh tokens.

### Impact
An attacker who previously obtained a refresh token retains access after password reset until the token expires.

### Credit
This issue was reported by [@bugbunny-research](https://github.com/bugbunny-research) (bugbunny.ai).

## Affected packages

- `nocodb <= 0.301.2`

## Remediation

Upgrade to a patched release:

- `nocodb 0.301.3`