Authentication Bypass in NocoDB Affects Vulnerable OAuth Implementations

CVE-2026-126276

What is CVE-2026-126276?

NocoDB versions prior to 2026.08.1 exhibit an authentication bypass flaw due to faulty PKCE implementation in oauth-token.service.ts. This vulnerability allows an attacker to exploit the OAuth token exchange process by treating PKCE as a substitute for traditional client authentication. Consequently, if an attacker captures an authorization code along with the PKCE verifier, they can forge access tokens and 60-day refresh tokens. This grants them the ability to impersonate a confidential client without the need for secret verification, leading to potential unauthorized access to sensitive data.

References