EUVD-2026-125241

NocoDB before 2026.08.0 contains a race condition in refresh-token rotation that allows attackers to reuse tokens because UserRefreshToken.ts never checks the affected-row count. Attackers holding a captured refresh token can present it concurrently with the legitimate user to obtain a valid...

PT-2026-146611

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.08.0 Description A race condition exists in the refresh-token rotation process. This occurs because the UserRefreshToken.ts file does not verify the affected-row count during the rotation. Consequently, an attacke...