Description
NocoDB before 2026.06.2 contains a race condition vulnerability in oauth-token.service.ts that allows attackers to reuse a refresh token by presenting it concurrently during non-atomic rotation. Attackers holding a captured refresh token can race the legitimate client to obtain their own access and refresh tokens, retaining scoped access without triggering reuse detection.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nocodb | nocodb | < 2026.06.2 | 2026.06.2 |
References
- GitHub Security Advisory (GHSA-353r-pj87-54hc) vendor-advisory
- VulnCheck Advisory: NocoDB before 2026.06.2 OAuth Refresh Token Rotation Race Condition third-party-advisory