NocoDB before 2026.06.2 OAuth Refresh Token Rotation Race Condition
Summary
NocoDB before 2026.06.2 contains a race condition vulnerability in oauth-token.service.ts that allows attackers to reuse a refresh token by presenting it concurrently during non-atomic rotation. Attackers holding a captured refresh token can race the legitimate client to obtain their own access and...
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| nocodbnocodb |
< 2026.06.2→ 2026.06.2 |
2026.06.2 |
Original description The description as published by the source.
NocoDB before 2026.06.2 contains a race condition vulnerability in oauth-token.service.ts that allows attackers to reuse a refresh token by presenting it concurrently during non-atomic rotation. Attackers holding a captured refresh token can race the legitimate client to obtain their own access and refresh tokens, retaining scoped access without triggering reuse detection.
Source: CVE.org (CVE Program・cvelistV5) NVD