CVE-2026-28396: NocoDB's Refresh Tokens Not Revoked on Password Reset

March 2, 2026 (updated November 5, 2026)

The password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password.

References

github.com/advisories/GHSA-x4vh-j75g-268g
github.com/nocodb/nocodb/commit/dfbe836577354ba780563a5cf8cb50bfc61a203e
github.com/nocodb/nocodb/releases/tag/0.301.3
github.com/nocodb/nocodb/security/advisories/GHSA-x4vh-j75g-268g
nvd.nist.gov/vuln/detail/CVE-2026-28396

Code Behaviors & Features

Detect and mitigate CVE-2026-28396 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →