Open redirect in NocoDB - CVE-2026-24768
Published: April 27, 2026
Vulnerability identifier: #VU127979
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-24768
CWE-ID: CWE-601
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: nocodb
Affected software:
NocoDB
NocoDB
Detailed vulnerability description
The vulnerability allows a remote attacker to redirect authenticated users to an arbitrary external website.
The vulnerability exists due to url redirection to untrusted site in the login flow via the continueAfterSignIn parameter when handling login requests with a user-controlled redirect target. A remote attacker can send a crafted login link to redirect authenticated users to an arbitrary external website.
User interaction is required because the victim must click a crafted login link and complete authentication.
How to mitigate CVE-2026-24768
Install security update from vendor's website.