CVE-2026-28396: 
JavaScript vulnerability analysis and mitigation

CVE-2026-28396 is an insufficient session expiration vulnerability in NocoDB, an open-source platform for building databases as spreadsheets. The flaw exists in the password reset flow, which fails to revoke existing refresh tokens, allowing an attacker who previously stole a refresh token to continue minting valid JWTs even after the victim resets their password. All NocoDB versions up to and including 0.301.2 (npm package) are affected. The vulnerability was disclosed on March 2, 2026, and carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 4.9 (Medium) (GitHub Advisory, NocoDB Advisory).

The root cause is classified as CWE-613 (Insufficient Session Expiration). Specifically, the passwordReset() function in users.service.ts updated the token_version field (which invalidates existing JWTs) but failed to call UserRefreshToken.deleteAllUserToken() to purge stored refresh tokens. The refreshToken() method only checked for token existence, not the token_version, meaning a stolen refresh token could still be exchanged for a valid JWT post-password-reset. By contrast, passwordChange() and signOut() both correctly deleted all refresh tokens, indicating the omission was specific to the password reset code path. An attacker must have previously obtained a valid refresh token (e.g., via session hijacking, phishing, or credential theft) to exploit this flaw (NocoDB Advisory, GitHub Advisory).

An attacker who possesses a stolen refresh token can maintain persistent unauthorized access to a victim's NocoDB account even after the victim resets their password, effectively bypassing the primary account recovery security measure. This persistent access allows the attacker to view, modify, or delete sensitive data stored in the victim's NocoDB databases. The impact is primarily on data integrity, with no direct availability or confidentiality impact scored, though unauthorized data access and manipulation remain significant risks for organizations using NocoDB to manage sensitive information (GitHub Advisory, NocoDB Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.042% (13th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a precondition — the attacker must have already obtained a valid refresh token through a separate attack vector before the victim initiates a password reset (GitHub Advisory).

1. Obtain a Refresh Token: The attacker first acquires a valid NocoDB refresh token from the target account through a prior attack — such as session hijacking, network interception, phishing, or exploiting another vulnerability that exposes authentication tokens.
2. Wait for Password Reset: The attacker monitors or waits for the victim to initiate a password reset (e.g., after detecting suspicious activity), which would normally be expected to invalidate all active sessions.
3. Attempt Token Refresh: After the victim resets their password, the attacker sends an HTTP request to the NocoDB token refresh endpoint using the previously stolen refresh token.
4. Receive Valid JWT: Because passwordReset() does not call UserRefreshToken.deleteAllUserToken(), the refresh token remains valid in the database. The refreshToken() method accepts it and issues a new, valid JWT.
5. Maintain Persistent Access: The attacker uses the newly minted JWT to authenticate API requests, accessing and manipulating the victim's NocoDB databases until the refresh token naturally expires (NocoDB Advisory).

• Network: API requests to the NocoDB token refresh endpoint originating from IP addresses or user agents inconsistent with the legitimate account owner's typical access patterns, particularly occurring shortly after a password reset event.
• Logs: NocoDB authentication logs showing successful token refresh operations for a user account immediately following or concurrent with a password reset event; JWT issuance events from refresh tokens that predate the password reset timestamp.
• Application Behavior: User account activity (data reads, modifications, or deletions) occurring from sessions that were established before a password reset, or from geographic locations/devices not associated with the legitimate user.

Upgrade NocoDB to version 0.301.3 or later, which resolves the issue by ensuring the password reset flow properly calls UserRefreshToken.deleteAllUserToken() to invalidate all existing refresh tokens (NocoDB Release). For deployments where an immediate upgrade is not feasible, administrators should consider implementing manual session termination for affected accounts and reviewing access logs for suspicious token usage following any password reset events. Monitoring authentication logs for anomalous refresh token activity post-password-reset is recommended as a compensating control (GitHub Advisory).

The vulnerability was responsibly reported by @bugbunny-research from bugbunny.ai and was acknowledged in the NocoDB 0.301.3 release notes alongside several other security fixes (NocoDB Release). The advisory was published by NocoDB maintainer @mertmit on March 2, 2026. No significant broader media coverage or notable community commentary beyond the GitHub advisory has been identified.