CVE-2026-47386
Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, two concurrent token-exchange requests using the same OAuth authorization code could each mint a distinct valid (access_token, refresh_token) pair, breaking the single-use guarantee that PKCE relies on. This vulnerability is fixed in 2026.05.1.
Summary dbcve.org
In NocoDB prior to 2026.05.1, a race condition exists in the OAuth token exchange endpoint where two concurrent requests using the same authorization code can both succeed, each minting distinct valid token pairs. This breaks PKCE's single-use guarantee for authorization codes, potentially allowing token theft via request interception or forced concurrent requests.
Mitigation
Upgrade to NocoDB version 2026.05.1 or later, which implements proper atomic consumption of authorization codes to enforce single-use semantics.