Improper Authentication in NocoDB - CVE-2026-126276
Published: November 9, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU162891
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126276
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated local attacker to obtain access tokens and 60-day refresh tokens for a confidential OAuth client without its secret.
The vulnerability exists due to NocoDB's OAuth token endpoint treating PKCE as a substitute for client authentication when the client secret is omitted. An unauthenticated local attacker who captures an authorization code and matching PKCE verifier after victim authorization can exchange them for tokens without a NocoDB session.
Affected software
NocoDB
How to mitigate CVE-2026-126276
Install security update from vendor's website.
NocoDB - update to 2026.08.1