CVE-2026-28396CWE-613

NocoDB: Refresh Tokens Not Revoked on Password Reset

Medium · published March 2, 2026

CVSS v4.0
4.9
EPSS
0%
Percentile
24.9
In the wild
Unconfirmed
What it is

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password. This issue has been patched in version 0.301.3.

The record
Technical detail
CVSS v4.0
4.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
EPSS
0.00331 · 24.9th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-03-02T16:18Z
EPSS history
Timeline
  • 02 MAR 16:18Z
    NocoDB: Refresh Tokens Not Revoked on Password Reset
    cvelistv5