CVE-2026-53926CWE-613

NocoDB: OAuth Tokens Persist Through Security Events

Medium · published June 23, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
33.7
In the wild
Unconfirmed
What it is

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, revokeAllOAuthTokensByUser in the users service is an empty stub being called from passwordChange, passwordForgot, and passwordReset. OAuth access and refresh tokens were not revoked when the user changed, reset, or recovered their password, leaving an attacker-issued OAuth grant valid after the user believed they had locked the attacker out. This vulnerability is fixed in 2026.05.1.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00406 · 33.7th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-06-23T20:08Z
EPSS history
Timeline
  • 23 JUN 20:08Z
    NocoDB: OAuth Tokens Persist Through Security Events
    cvelistv5