CVE-2026-47386
CVE-2026-47386 · NocoDB: OAuth Authorization Code Race Condition
This page contains facts from public vulnerability sources. Check the original advisory before updating.
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, two concurrent token-exchange requests using the same OAuth authorization code could each mint a distinct valid (access_token, refresh_token) pair, breaking the single-use guarantee that PKCE relies on. This vulnerability is fixed in 2026.05.1.
CVSS 6.3 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node