Executive Summary

This vulnerability is an unvalidated redirect (open redirect) in NocoDB's login flow prior to version 0.301.0. It occurs because the `continueAfterSignIn` parameter is not validated, allowing attackers to redirect authenticated users to arbitrary external websites after login. This can be exploited to conduct phishing attacks by leveraging user trust in the legitimate login process. The vulnerability does not expose credentials directly or bypass authentication but increases the risk of credential theft through social engineering.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by enabling attackers to redirect authenticated users to malicious external sites after login, facilitating phishing attacks. This undermines the integrity of the authentication process and increases the likelihood of credential theft through social engineering. However, it does not allow attackers to execute arbitrary code or escalate privileges.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NocoDB to version 0.301.0 or later, as this version fixes the unvalidated redirect vulnerability in the login flow by properly validating the `continueAfterSignIn` parameter.

Useful 0 Not Useful 0