GHSA-R989-7G3J-WJHW中危已审查

NocoDB: Refresh Tokens Persist Through Password Recovery

OSV 1.4.0 · github-reviewed · 修改于 2026-07-21 05:20

发布时间

2026-06-17 22:07

GitHub 审查时间

2026-06-17 22:07

NVD 发布时间

2026-06-24 05:17

源文件

advisories/github-reviewed/2026/06/GHSA-r989-7g3j-wjhw/GHSA-r989-7g3j-wjhw.json

公告说明

Summary

A stolen refresh token survived a password-forgot flow and could be used to mint fresh JWTs even after the user reset their password.

Details

passwordChange and passwordReset deleted the user's refresh tokens, but passwordForgot only rotated token_version and revoked OAuth tokens — it did not call UserRefreshToken.deleteAllUserToken(user.id). An attacker holding a captured refresh cookie could still exchange it for a new access token after the victim triggered the recovery flow.

Impact

Persistent unauthorized access after password recovery. Once a refresh token leaks, the documented "Forgot password" recovery flow did not in fact revoke the attacker's session.

Credit

This issue was reported by @bugbunny-research.

受影响的软件包

npm

nocodb

标识信息

别名 / CVE

CVE-2026-53928

CWE

CWE-613

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V4

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

原始 OSV JSON

{
  "id": "GHSA-r989-7g3j-wjhw",
  "aliases": [
    "CVE-2026-53928"
  ],
  "details": "### Summary\nA stolen refresh token survived a password-forgot flow and could be used to mint fresh\nJWTs even after the user reset their password.\n\n### Details\n`passwordChange` and `passwordReset` deleted the user's refresh tokens, but\n`passwordForgot` only rotated `token_version` and revoked OAuth tokens — it did not\ncall `UserRefreshToken.deleteAllUserToken(user.id)`. An attacker holding a captured\nrefresh cookie could still exchange it for a new access token after the victim\ntriggered the recovery flow.\n\n### Impact\nPersistent unauthorized access after password recovery. Once a refresh token leaks, the\ndocumented \"Forgot password\" recovery flow did not in fact revoke the attacker's\nsession.\n\n### Credit\nThis issue was reported by [@bugbunny-research](https://github.com/bugbunny-research).",
  "summary": "NocoDB: Refresh Tokens Persist Through Password Recovery",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.301.3"
            }
          ]
        }
      ],
      "package": {
        "name": "nocodb",
        "ecosystem": "npm"
      }
    }
  ],
  "modified": "2026-07-20T21:20:05Z",
  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
    }
  ],
  "published": "2026-06-17T14:07:33Z",
  "references": [
    {
      "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-r989-7g3j-wjhw",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53928",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/nocodb/nocodb",
      "type": "PACKAGE"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2026-06-23T21:17:01Z",
    "github_reviewed_at": "2026-06-17T14:07:33Z"
  }
}