| Package | Affected versions | Patched versions |
|---|---|---|
| nocodb | < 0.301.3 | 0.301.3 |
| nocodb | < 0.301.3 | 0.301.3 |
The password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password.
passwordReset() in users.service.ts updated token_version (invalidating JWTs) but did not call UserRefreshToken.deleteAllUserToken(). The refreshToken() method only checked token existence, not token_version. Both passwordChange() and signOut() correctly deleted all refresh tokens.
An attacker who previously obtained a refresh token retains access after password reset until the token expires.
This issue was reported by @bugbunny-research (bugbunny.ai).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free