| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| nocodb | < 0.301.3 | 0.301.3 |
| nocodb | < 0.301.3 | 0.301.3 |
The password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password.
passwordReset() in users.service.ts updated token_version (invalidating JWTs) but did not call UserRefreshToken.deleteAllUserToken(). The refreshToken() method only checked token existence, not token_version. Both passwordChange() and signOut() correctly deleted all refresh tokens.
An attacker who previously obtained a refresh token retains access after password reset until the token expires.
This issue was reported by @bugbunny-research (bugbunny.ai).
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン