CVE-2026-53928
2026-06-23
21h17 +00:00
21h17 +00:00
Thông báo cho một CVE
Luôn được thông báo về mọi thay đổi đối với một CVE cụ thể.
Mô tả CVE
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a stolen refresh token survived a password-forgot flow and could be used to mint fresh JWTs even after the user reset their password. passwordChange and passwordReset deleted the user's refresh tokens, but passwordForgot only rotated token_version and revoked OAuth tokens — it did not call UserRefreshToken.deleteAllUserToken(user.id). An attacker holding a captured refresh cookie could still exchange it for a new access token after the victim triggered the recovery flow. This vulnerability is fixed in 2026.05.1.
Thông tin CVE
Điểm yếu liên quan
| Tên điểm yếu | Nguồn | |
|---|---|---|
| DEPRECATED: Insufficient Session Expiration This entry has been deprecated because it was insufficiently clear. Consider CWE-1462 and its descendants. |
