Is there a patch available for EUVD-2026-38608?

Yes, a patch is available for EUVD-2026-38608. Update the affected software to the latest version immediately.

NocoDB EUVD-2026-38608

Q: What is the CVSS score of EUVD-2026-38608?

EUVD-2026-38608 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-53928 MEDIUM

Insufficient Session Expiration (CWE-613)

2026-06-17 https://github.com/nocodb/nocodb

GHSA-r989-7g3j-wjhw

Authentication Bypass Microsoft

6.3

CVSS 4.0 · Vendor: https://github.com/nocodb/nocodb

Severity by source

Vendor (https://github.com/nocodb/nocodb) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

AC:H because prior refresh-token capture is a prerequisite; UI:R because the victim must trigger the Forgot Password flow for the bypass to apply.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/nocodb/nocodb).

CVSS VectorVendor: https://github.com/nocodb/nocodb

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 23, 2026 - 23:02 EUVD

CVSS changed

Jun 23, 2026 - 21:22 NVD

6.3 (MEDIUM)

Source Code Evidence Fetched

Jun 18, 2026 - 01:46 vuln.today

Analysis Generated

Jun 18, 2026 - 01:46 vuln.today

DescriptionCVE.org

Summary

A stolen refresh token survived a password-forgot flow and could be used to mint fresh JWTs even after the user reset their password.

Details

passwordChange and passwordReset deleted the user's refresh tokens, but passwordForgot only rotated token_version and revoked OAuth tokens - it did not call UserRefreshToken.deleteAllUserToken(user.id). An attacker holding a captured refresh cookie could still exchange it for a new access token after the victim triggered the recovery flow.

Impact

Persistent unauthorized access after password recovery. Once a refresh token leaks, the documented "Forgot password" recovery flow did not in fact revoke the attacker's session.

Credit

This issue was reported by @bugbunny-research.

AnalysisAI

Refresh token persistence in NocoDB (npm/nocodb ≤ 0.301.3) allows an attacker who has captured a victim's refresh token to retain persistent account access even after the victim completes a 'Forgot Password' recovery flow. The passwordForgot code path omitted the UserRefreshToken.deleteAllUserToken(user.id) call present in both passwordChange and passwordReset, leaving the attacker's stolen refresh cookie valid and exchangeable for new JWTs indefinitely. No public exploit has been identified at time of analysis, and no vendor-released patch version is confirmed in the available advisory data.

Technical ContextAI

NocoDB is an open-source no-code database platform distributed as an npm package (pkg:npm/nocodb). Its authentication model uses long-lived refresh tokens stored as HTTP cookies, which are exchanged for short-lived JWTs on each authenticated request. CWE-613 (Insufficient Session Expiration) describes the root cause class: failing to invalidate all active sessions upon a security-relevant credential change event. Three server-side functions handle password operations - passwordChange, passwordReset, and passwordForgot - of which only the first two correctly call UserRefreshToken.deleteAllUserToken(user.id) to purge all persisted refresh tokens for a given user. The passwordForgot path instead rotated only the internal token_version field and revoked linked OAuth tokens, which is insufficient to invalidate a directly captured refresh token stored in the UserRefreshToken table. This inconsistency between functionally related code paths is the precise technical root cause.

RemediationAI

No vendor-released patch version has been confirmed - the GitHub Security Advisory GHSA-r989-7g3j-wjhw lists no fixed version as of the time of analysis. Operators should monitor https://github.com/nocodb/nocodb/releases and the advisory at https://github.com/nocodb/nocodb/security/advisories/GHSA-r989-7g3j-wjhw for a patched release and apply it immediately upon availability. As an interim compensating control, database administrators can manually purge UserRefreshToken table entries for any user who has initiated a 'Forgot Password' flow, forcing re-authentication; this requires direct database access and should be scripted carefully to avoid disrupting legitimate sessions. Reducing the configured refresh token TTL to a short window (e.g., hours rather than days) limits the persistence window at the trade-off of requiring more frequent re-authentication for all users. Monitoring for concurrent sessions from geographically or behaviorally anomalous sources may help detect exploitation attempts but will not prevent the vulnerability.