https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 13:06:44 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-330031 EUVD-2026-330031 https://cve.radiocsirt.org/vuln/euvd-2026-330031 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47386 <p>NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, two concurrent token-exchange requests using the same OAuth authorization code could each mint a distinct valid (access_token, refresh_token) pair, breaking the single-use guarantee that PKCE relies on. This vulnerability is fixed in 2026.05.1.</p> <p>NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, two concurrent token-exchange requests using the same OAuth authorization code could each mint a distinct valid (access_token, refresh_token) pair, breaking the single-use guarantee that PKCE relies on. This vulnerability is fixed in 2026.05.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-47386 https://cve.radiocsirt.org/vuln/ghsa-8m7c-hf24-5g47 <p><strong>Affected:</strong> npm: nocodb</p> <p>### Summary Two concurrent token-exchange requests using the same OAuth authorization code could each mint a distinct valid `(access_token, refresh_token)` pair, breaking the single-use guarantee that PKCE relies on.</p> <p>### Details The token-exchange flow read `is_used` and called `markAsUsed` as an unconditional update at the end of the path. A new `OAuthAuthorizationCode.claimByCode` method now performs an atomic compare-and-swap (`WHERE code = ? AND is_used = false`) and is called immediately before `OAuthToken.insert`, after redirect-URI, PKCE, and client authentication have all succeeded. Only the first concurrent caller&#39;s `UPDATE` wins; the rest see `invalid_grant: Authorization code has already been used`.</p> <p>### Impact An attacker who has observed an authorization code and the corresponding PKCE verifier (for example through a malicious OAuth-aware client or by racing a real exchange) could obtain a long-lived refresh token in addition to the legitimate one.</p> <p>### Credit This issue was reported by [@eddieran](https://github.com/eddieran).</p> <p><strong>Affected:</strong> npm: nocodb</p> <p>### Summary Two concurrent token-exchange requests using the same OAuth authorization code could each mint a distinct valid `(access_token, refresh_token)` pair, breaking the single-use guarantee that PKCE relies on.</p> <p>### Details The token-exchange flow read `is_used` and called `markAsUsed` as an unconditional update at the end of the path. A new `OAuthAuthorizationCode.claimByCode` method now performs an atomic compare-and-swap (`WHERE code = ? AND is_used = false`) and is called immediately before `OAuthToken.insert`, after redirect-URI, PKCE, and client authentication have all succeeded. Only the first concurrent caller&#39;s `UPDATE` wins; the rest see `invalid_grant: Authorization code has already been used`.</p> <p>### Impact An attacker who has observed an authorization code and the corresponding PKCE verifier (for example through a malicious OAuth-aware client or by racing a real exchange) could obtain a long-lived refresh token in addition to the legitimate one.</p> <p>### Credit This issue was reported by [@eddieran](https://github.com/eddieran).</p> https://cve.radiocsirt.org/vuln/ghsa-8m7c-hf24-5g47