Race Condition Vulnerability in NocoDB Product by NocoDB

CVE-2026-126287

What is CVE-2026-126287?

A race condition vulnerability exists in the oauth-token.service.ts of NocoDB versions before 2026.06.2. This flaw allows attackers to exploit the refresh token mechanism by concurrently presenting a captured refresh token during non-atomic rotation. Consequently, attackers can outpace legitimate clients to obtain both access and refresh tokens, thereby gaining unauthorized access without detection, as their actions do not trigger the usual reuse detection mechanisms.

References