Race Condition in NocoDB Refresh Token Rotation

CVE-2026-126280

What is CVE-2026-126280?

NocoDB versions prior to 2026.08.0 are affected by a vulnerability stemming from a race condition in the refresh token rotation process. This flaw allows attackers to exploit the refresh token mechanism by reusing tokens. Specifically, the UserRefreshToken.ts script fails to verify the affected-row count, enabling attackers to present a captured refresh token alongside a legitimate user session. Consequently, this enables them to gain unauthorized access without proper reuse tracking, posing significant risks to user security and data integrity.

References