NocoDB before 2026.06.2 OAuth Refresh Token Rotation Race Condition
概要
NocoDB before 2026.06.2 contains a race condition vulnerability in oauth-token.service.ts that allows attackers to reuse a refresh token by presenting it concurrently during non-atomic rotation. Attackers holding a captured refresh token can race the legitimate client to obtain their own access and...
影響パッケージ
| パッケージ | 影響を受ける版 → 修正版 | |
|---|---|---|
| nocodbnocodb |
2026.06.2 未満→ 2026.06.2 |
2026.06.2 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
NocoDB before 2026.06.2 contains a race condition vulnerability in oauth-token.service.ts that allows attackers to reuse a refresh token by presenting it concurrently during non-atomic rotation. Attackers holding a captured refresh token can race the legitimate client to obtain their own access and refresh tokens, retaining scoped access without triggering reuse detection.
出典: CVE.org (CVE Program・cvelistV5) NVD