| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| nocodb | ≤ 0.301.3 |
A stolen refresh token survived a password-forgot flow and could be used to mint fresh JWTs even after the user reset their password.
passwordChange and passwordReset deleted the user's refresh tokens, but
passwordForgot only rotated token_version and revoked OAuth tokens — it did not
call UserRefreshToken.deleteAllUserToken(user.id). An attacker holding a captured
refresh cookie could still exchange it for a new access token after the victim
triggered the recovery flow.
Persistent unauthorized access after password recovery. Once a refresh token leaks, the documented "Forgot password" recovery flow did not in fact revoke the attacker's session.
This issue was reported by @bugbunny-research.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン