NocoDB CVE-2026-53926

Exploitation requires that the attacker already possesses valid OAuth access and/or refresh tokens for the target NocoDB user account, obtained prior to the victim's password security event. The vulnerable condition is triggered specifically when the victim performs a passwordChange, passwordForgot, or passwordReset operation - the three flows that invoke the empty stub - believing this action will revoke all active sessions. Deployments that have not configured OAuth authentication and use only NocoDB's local authentication mechanism are not affected by token persistence, as there are no OAuth tokens to persist. Exploitation is further limited by the attacker needing to maintain access to valid tokens from the initial compromise; if tokens have expired naturally or been invalidated through other means, the attack window closes. The CVSS 4.0 AT:P metric confirms the prerequisite dependency: this is not exploitable against a default NocoDB installation without a prior token-acquisition step.

The vendor-assigned CVSS 4.0 score of 6.3 with AT:P correctly signals that exploitation is conditional - the attacker must have obtained valid OAuth tokens before the victim's remediation attempt. This is a persistence-maintenance vulnerability, not an initial-access vulnerability, which bounds its real-world severity considerably. EPSS data was not provided in the available intelligence, so exploitation probability cannot be independently quantified. There is no CISA KEV listing and no public exploit code has been identified, consistent with the targeted, prerequisite-heavy nature of the flaw. The vendor impact metrics (VI:L only, VC:N) reflect that no new access tier is gained - the attacker simply retains whatever access level the OAuth grant originally provided. For organizations where NocoDB OAuth is actively used and where credential theft is a realistic threat model (e.g., shared or externally-accessible instances), the risk is meaningful: password reset as a remediation action would provide false confidence. For deployments using only local authentication without OAuth, risk is negligible. The AT:P metric in the provided CVSS 4.0 vector is consistent with the description; no conflicting signals exist in the available data.

An attacker who previously obtained a NocoDB user's OAuth access and refresh tokens - through phishing, a malicious OAuth application grant, or credential theft - continues to use those tokens to authenticate against the victim's account after the victim performs a password reset specifically to terminate unauthorized sessions. Because the revocation stub does nothing, the attacker's OAuth session silently persists with full account-level access to the victim's databases and spreadsheets. No public exploit code is known, but the attack requires nothing more than a standard OAuth token usage pattern once the prerequisite tokens are in hand.