CVE-2026-24768: 
JavaScript vulnerability analysis and mitigation

CVE-2026-24768 is an unvalidated redirect (open redirect) vulnerability in NocoDB's login flow, caused by missing validation of the continueAfterSignIn query parameter. It affects all NocoDB versions prior to 0.301.0 (with the vulnerability present from versions before 0.265.1 as noted in the vendor advisory). The vulnerability was discovered by an AI agent developed by the GitHub Security Lab, reviewed by GHSL team members, and publicly disclosed on January 28, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 5.7 (Medium) (GitHub Advisory, NocoDB Advisory).

The root cause is classified as CWE-601 (URL Redirection to Untrusted Site / Open Redirect). The redirect logic in NocoDB's redirect plugin uses a permissive helper function isFullUrl with the regular expression /^(https?:)?\//, which matches any HTTP(S) or protocol-relative URL (e.g., //evil.example) without restricting allowed domains or origins. When the continueAfterSignIn query parameter matches this pattern, the application unconditionally performs client-side navigation via navigateTo(route.value.query.continueAfterSignIn as string, { external: isFullUrl(...) }), sending the authenticated user to an arbitrary external destination. No authentication or special privileges are required to craft the malicious URL, though user interaction (clicking the link and completing login) is necessary (GitHub Advisory, NocoDB Advisory).

The primary impact is enabling phishing attacks that leverage user trust in the legitimate NocoDB login flow. After a victim authenticates on the real NocoDB instance, they are silently redirected to an attacker-controlled site, which can then harvest credentials or sensitive information through social engineering (e.g., displaying a fake error and prompting re-entry of credentials). The vulnerability does not allow arbitrary code execution, privilege escalation, or direct credential exposure, and has no impact on availability; however, it undermines authentication integrity and increases the risk of account compromise through indirect credential theft (GitHub Advisory, NocoDB Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available standalone proof-of-concept exploit at this time. The CVSS v4.0 exploit maturity is listed as "Proof of Concept," and the EPSS score is approximately 0.022% (6th percentile), indicating a low probability of near-term exploitation. No threat actor attribution or CISA KEV catalog listing has been identified for this vulnerability (GitHub Advisory, NocoDB Advisory).

1. Reconnaissance: Identify publicly accessible NocoDB instances running versions prior to 0.301.0 using search engines, Shodan, or Censys, targeting the login page at /#/signin.
2. Craft malicious URL: Construct a login URL embedding the attacker-controlled redirect destination in the continueAfterSignIn parameter, for example: https://victim-nocodb.example/#/signin?continueAfterSignIn=https://evil-phishing.com/fake-login
3. Deliver phishing link: Send the crafted URL to the target victim via email, chat, or other social engineering channels, presenting it as a legitimate NocoDB login link.
4. Victim authenticates: The victim clicks the link, is presented with the genuine NocoDB login page, and enters valid credentials — completing normal authentication.
5. Redirect to attacker site: Upon successful login, NocoDB's redirect plugin evaluates the continueAfterSignIn parameter, matches it against the permissive isFullUrl regex, and navigates the victim's browser to the attacker-controlled external site.
6. Credential harvesting: The attacker's site displays a convincing fake error or re-authentication prompt, causing the victim to unknowingly submit credentials to the attacker (GitHub Advisory, NocoDB Advisory).

• Network: Outbound browser redirects from a NocoDB instance to external domains immediately following user authentication; HTTP referrer headers from nocodb login pages appearing in logs of external/unknown sites.
• Logs: NocoDB access logs showing login requests to /#/signin with a continueAfterSignIn query parameter containing an absolute URL (e.g., https:// or //) pointing to an external domain; repeated occurrences from different source IPs may indicate a phishing campaign.
• User Reports: Users reporting unexpected redirects to unfamiliar websites immediately after logging into NocoDB, or receiving prompts to re-enter credentials on a page that does not match the expected NocoDB interface (GitHub Advisory).

Upgrade NocoDB to version 0.301.0 or later, which fixes the open redirect vulnerability by enforcing origin/domain validation on the continueAfterSignIn parameter. For environments unable to patch immediately, implement network-level or WAF rules to detect and block login requests containing absolute external URLs in the continueAfterSignIn parameter. Additionally, educate users to verify the destination URL after login and to be suspicious of unexpected post-authentication redirects (GitHub Advisory, NocoDB Advisory).

The vulnerability was discovered by an AI agent developed by the GitHub Security Lab and reviewed by GHSL team members Peter Stöckli (@p-) and Man Yue Mo (@m-y-mo), highlighting the growing role of automated security tooling in vulnerability discovery. The advisory was published and patched on the same day (January 28, 2026), indicating a coordinated disclosure process. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability database aggregation (GitHub Advisory, NocoDB Advisory).