| Package | Affected versions | Patched versions |
|---|---|---|
| nocodb | ≤ 0.301.3 |
A stolen refresh token survived a password-forgot flow and could be used to mint fresh JWTs even after the user reset their password.
passwordChange and passwordReset deleted the user's refresh tokens, but
passwordForgot only rotated token_version and revoked OAuth tokens — it did not
call UserRefreshToken.deleteAllUserToken(user.id). An attacker holding a captured
refresh cookie could still exchange it for a new access token after the victim
triggered the recovery flow.
Persistent unauthorized access after password recovery. Once a refresh token leaks, the documented "Forgot password" recovery flow did not in fact revoke the attacker's session.
This issue was reported by @bugbunny-research.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free