NocoDB's Refresh Tokens Not Revoked on Password Reset
Summary
The password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password.
Details
passwordReset() in users.service.ts updated token_version (invalidating JWTs) but did not call UserRefreshToken.deleteAllUserToken(). The refreshToken() method only checked token existence, not token_version. Both passwordChange() and signOut() correctly deleted all refresh tokens.
Impact
An attacker who previously obtained a refresh token retains access after password reset until the token expires.
Credit
This issue was reported by @bugbunny-research (bugbunny.ai).
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | nocodb | < 0.301.3 | 0.301.3 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U- Weakness (CWE)
CWE-613- Platform
- npm
- Package
nocodb- Disclosed
- 02.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-x4vh-j75g-268g - CC BY 4.0
Vulnerability history: nocodb
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 54
- First → latest
- 06.2022 06.2026
- Without a fix
- 13
- Exploited in attacks
- 0
Severity breakdown
- High 7
- Medium 41
- Low 6
Disclosures per year
- 2022: 5
- 2023: 2
- 2024: 3
- 2025: 1
- 2026: 43
-
NocoDB's Refresh Tokens Not Revoked on Password Reset this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.