Description
NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid reset token to perform multiple password changes by sending concurrent reset requests. Attackers can exploit the window created by slow bcrypt hashing before the token is cleared to overwrite the owner's new password and lock them out.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nocodb | nocodb | < 2026.08.1 | 2026.08.1 |
References
- GitHub Security Advisory (GHSA-7mf9-q77p-r4r3) vendor-advisory
- VulnCheck Advisory: NocoDB before 2026.08.1 Password Reset Token Race Condition third-party-advisory