{"id":"CVE-2026-53928","title":"NocoDB: Refresh Tokens Persist Through Password Recovery","summary":"NocoDB: Refresh Tokens Persist Through Password Recovery","severity":"medium","cwe":["CWE-613"],"vendor":"nocodb","product":"nocodb","ecosystem":"npm","affected":["nocodb <= 0.301.3"],"published":"2026-06-17","updated":"2026-06-17","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-r989-7g3j-wjhw","references":[{"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-r989-7g3j-wjhw"},{"url":"https://github.com/advisories/GHSA-r989-7g3j-wjhw"}],"tags":["ghsa","npm"],"epss":0.00314,"epssPercentile":0.2158,"ingestedAt":"2026-06-29T14:31:47.435Z","slug":"CVE-2026-53928","body":"## Overview\n\n### Summary\nA stolen refresh token survived a password-forgot flow and could be used to mint fresh\nJWTs even after the user reset their password.\n\n### Details\n`passwordChange` and `passwordReset` deleted the user's refresh tokens, but\n`passwordForgot` only rotated `token_version` and revoked OAuth tokens — it did not\ncall `UserRefreshToken.deleteAllUserToken(user.id)`. An attacker holding a captured\nrefresh cookie could still exchange it for a new access token after the victim\ntriggered the recovery flow.\n\n### Impact\nPersistent unauthorized access after password recovery. Once a refresh token leaks, the\ndocumented \"Forgot password\" recovery flow did not in fact revoke the attacker's\nsession.\n\n### Credit\nThis issue was reported by [@bugbunny-research](https://github.com/bugbunny-research).\n\n## Affected packages\n\n- `nocodb <= 0.301.3`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}