CVE-2026-126276
Received Received - Intake

Authentication Bypass in NocoDB via PKCE Misuse

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
NocoDB before 2026.08.1 contains an authentication bypass vulnerability in oauth-token.service.ts that treats PKCE as a substitute for confidential client authentication, skipping client secret verification when omitted. Attackers holding a captured authorization code and PKCE verifier can mint access tokens and 60-day refresh tokens for a confidential client without knowing its secret.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126276
EUVD
EUVD-2026-125245

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nocodb nocodb to 2026.08.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

NocoDB before 2026.08.1 has an authentication bypass flaw in oauth-token.service.ts where PKCE is incorrectly treated as a replacement for client secret verification. Attackers with a captured authorization code and PKCE verifier can obtain access tokens and 60-day refresh tokens for a confidential client without knowing its secret.

Impact Analysis

An attacker could gain unauthorized access to sensitive data or perform actions on behalf of legitimate users. This could lead to data breaches, unauthorized modifications, or prolonged access via long-lived refresh tokens.

Compliance Impact

This vulnerability could lead to unauthorized data access or exposure, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using affected NocoDB versions may face compliance violations and potential penalties.

Mitigation Strategies

Upgrade NocoDB to version 2026.08.1 or later to address the authentication bypass vulnerability. Ensure client secrets are enforced during OAuth token requests and disable PKCE as a substitute for client secret verification.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126276. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...