CVE-2026-47386 Details
Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, two concurrent token-exchange requests using the same OAuth authorization code could each mint a distinct valid (access_token, refresh_token) pair, breaking the single-use guarantee that PKCE relies on. This vulnerability is fixed in 2026.05.1.
A vulnerability exists in NocoDB versions through 2026.05.0, where two simultaneous token-exchange requests using the same OAuth authorization code could each generate a valid pair of access and refresh tokens. This issue disrupts the single-use guarantee that Proof Key for Code Exchange (PKCE) relies on. The vulnerability arises because the token-exchange process unconditionally updated the 'is_used' status, allowing for concurrent requests to successfully exchange the same authorization code. An attacker who intercepts an authorization code and its corresponding PKCE verifier could exploit this flaw to obtain an additional long-lived refresh token.
Users can upgrade to NocoDB version 2026.05.1 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 23, 2026CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nocodb/nocodb/security/advisories/GHSA-8m7c-hf24-5g47 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NocoDB | <= 2026.05.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |