Insufficient Session Expiration in NocoDB - #VU162868
Published: November 9, 2026
Vulnerability identifier: #VU162868
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-613
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker to retain access to a victim's NocoDB account after OAuth grant revocation.
The vulnerability exists due to NocoDB's session authentication accepting OAuth access tokens signed with the same secret without checking revocation when submitted through the session header. A remote authenticated attacker holding an unexpired OAuth token from an OAuth or MCP integration can reuse it to modify the victim's profile or force a global sign-out.
Affected software
NocoDB
Remediation
Install security update from vendor's website.
NocoDB - update to 2026.10.1