Insufficient Session Expiration in NocoDB - CVE-2026-28396
Published: April 27, 2026
Vulnerability identifier: #VU127986
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-28396
CWE-ID: CWE-613
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to maintain unauthorized access to the victim's account after a password reset.
The vulnerability exists due to insufficient session expiration in users.service.ts when processing password reset requests. A remote user can use a previously stolen refresh token to maintain unauthorized access to the victim's account after a password reset.
The issue occurs because existing refresh tokens remain valid and can still be used to mint valid JWTs until the token expires.
Affected software
NocoDB
How to mitigate CVE-2026-28396
Install security update from vendor's website.
NocoDB - update to 0.301.3