CVE-2026-126280
Received Received - Intake

Race Condition in NocoDB Token Rotation Allows Session Reuse

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
NocoDB before 2026.08.0 contains a race condition in refresh-token rotation that allows attackers to reuse tokens because UserRefreshToken.ts never checks the affected-row count. Attackers holding a captured refresh token can present it concurrently with the legitimate user to obtain a valid authenticated session, and no reuse event is recorded.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126280
EUVD
EUVD-2026-125241

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nocodb nocodb to 2026.08.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-126280 is a race condition in NocoDB's refresh-token rotation mechanism. The system fails to check if a token update affects any rows, allowing two concurrent requests using the same refresh token to each generate a new valid token and session. This bypasses the single-use property of refresh tokens, enabling unauthorized access without detection.

Detection Guidance

Detecting this vulnerability requires monitoring for concurrent refresh token usage. Check NocoDB logs for multiple successful token rotations from the same refresh token within a short timeframe. Look for UserRefreshToken.ts errors or unexpected session creation patterns. No direct commands are provided in the resources, but inspecting database logs for token updates without proper row checks may indicate exploitation.

Impact Analysis

If you use NocoDB versions before 2026.08.0, an attacker with a captured refresh token could gain access to your authenticated session by presenting the token concurrently with you. The attack leaves no trace, making it hard to detect. This could lead to unauthorized data access or manipulation.

Compliance Impact

This vulnerability could violate compliance requirements that mandate secure authentication and session management, such as GDPR's data protection principles or HIPAA's access controls. Unauthorized access risks data breaches, leading to potential legal and financial penalties for non-compliance.

Mitigation Strategies

Upgrade NocoDB to version 2026.08.0 or later immediately. Review and enforce atomic refresh token rotation in UserRefreshToken.ts to ensure single-use tokens. Monitor for concurrent token usage attempts and revoke suspicious sessions. Disable refresh token reuse logging if not already enabled.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126280. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...