https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T01:49:43.114560+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2026-13836 cnvd-2026-13836 2026-10-06T01:49:43.118890+00:00 cnvd-2026-13836 https://cve.radiocsirt.org/vuln/euvd-2026-274086 EUVD-2026-274086 2026-10-06T01:49:43.118927+00:00 EUVD-2026-274086 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28396 fkie_cve-2026-28396 2026-10-06T01:49:43.118941+00:00

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password. This issue has been patched in version 0.301.3.

 https://cve.radiocsirt.org/vuln/ghsa-x4vh-j75g-268g GHSA-x4vh-j75g-268g — NocoDB's Refresh Tokens Not Revoked on Password Reset 2026-10-06T01:49:43.118971+00:00

Affected: npm: nocodb

### Summary The password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password.

### Details `passwordReset()` in `users.service.ts` updated `token_version` (invalidating JWTs) but did not call `UserRefreshToken.deleteAllUserToken()`. The `refreshToken()` method only checked token existence, not `token_version`. Both `passwordChange()` and `signOut()` correctly deleted all refresh tokens.

### Impact An attacker who previously obtained a refresh token retains access after password reset until the token expires.

### Credit This issue was reported by [@bugbunny-research](https://github.com/bugbunny-research) (bugbunny.ai).