CVE-2026-47386 PUBLISHED

NocoDB: OAuth Authorization Code Race Condition

Assigner: GitHub_M
Reserved: 19.05.2026 Published: 23.06.2026 Updated: 23.06.2026

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, two concurrent token-exchange requests using the same OAuth authorization code could each mint a distinct valid (access_token, refresh_token) pair, breaking the single-use guarantee that PKCE relies on. This vulnerability is fixed in 2026.05.1.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	None	Confidentiality	None
Attack Complexity	High	Integrity	Low	Integrity	None
Attack Requirements	Present	Availability	None	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	nocodb
Product	nocodb
Versions	Version < 2026.05.1 is affected

References

https://github.com/nocodb/nocodb/security/advisories/GHSA-8m7c-hf24-5g47

Problem Types

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE