{"id":"CVE-2026-126276","kind":"vulnerability","aliases":["CVE-2026-126276"],"related":[],"title":"NocoDB: OAuth token endpoint skips client secret check, enabling token minting","description":"NocoDB before 2026.08.1 contains an authentication bypass vulnerability in oauth-token.service.ts that treats PKCE as a substitute for confidential client authentication, skipping client secret verification when omitted. Attackers holding a captured authorization code and PKCE verifier can mint access tokens and 60-day refresh tokens for a confidential client without knowing its secret.","summary":"NocoDB before 2026.08.1 skips client secret verification at its OAuth token endpoint when PKCE parameters are supplied. An attacker who holds a captured authorization code and PKCE verifier can mint access tokens and 60-day refresh tokens for a confidential client without its secret.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nocodb","oauth","package","self-hosted"],"not_affected_if":["fixed-version","no-oauth-clients"],"how_to_check":"- Check the NocoDB version you run; affected builds are those before `2026.08.1`.\n- Review whether any OAuth client registered with NocoDB is confidential (has a client secret).","fix":"- NocoDB: move to `2026.08.1` or later.","status":"open","published_at":"2026-11-13T10:17:30+00:00","first_seen_at":"2026-11-13T10:47:12+00:00","triaged_at":"2026-11-13T10:52:19+00:00","updated_at":"2026-11-13T10:52:19+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T10:52:19Z","model":"claude-haiku-5-5","output":{"fix":"- NocoDB: move to `2026.08.1` or later.","reach":"internet","title":"NocoDB: OAuth token endpoint skips client secret check, enabling token minting","impact":"high","summary":"NocoDB before 2026.08.1 skips client secret verification at its OAuth token endpoint when PKCE parameters are supplied. An attacker who holds a captured authorization code and PKCE verifier can mint access tokens and 60-day refresh tokens for a confidential client without its secret.","audience":"businesses","category":"package","nicknames":[],"who_cares":["nocodb","self-hosted","oauth"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"attacker mints long-lived tokens for confidential OAuth clients","analyst_note":"","how_to_check":"- Check the NocoDB version you run; affected builds are those before `2026.08.1`.\n- Review whether any OAuth client registered with NocoDB is confidential (has a client secret).","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","no-oauth-clients"],"who_is_affected":"Teams that self-host NocoDB and use OAuth clients registered as confidential clients are exposed, since the flaw lets an attacker with a captured authorization code and verifier skip the client secret. Installations on a version at or after `2026.08.1`, or that use no OAuth integrations, are not affected by this flaw as described.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000734,"input_tokens":4627,"output_tokens":543,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126276':14A,17A '-2026':13A,16A '2026.08.1':26B,70C '60':57B,108C 'access':54B,105C 'attack':42B,94C 'authent':73C,87C 'author':47B,98C 'bypass':74C 'captur':46B,97C 'check':8A 'client':6A,28B,64B,86C,89C,115C 'code':48B,99C 'confidenti':63B,85C,114C 'contain':71C 'cve':12A,15A 'day':58B,109C 'enabl':9A 'endpoint':4A,35B 'hold':44B,95C 'host':23B 'know':117C 'mint':11A,53B,104C 'nocodb':1A,18B,24B,68C 'oauth':2A,19B,33B 'oauth-token.service.ts':77C 'omit':93C 'packag':20B 'paramet':38B 'pkce':37B,50B,80C,101C 'refresh':59B,110C 'secret':7A,29B,67B,90C,119C 'self':22B 'self-host':21B 'skip':5A,27B,88C 'substitut':83C 'suppli':40B 'token':3A,10A,34B,55B,60B,106C,111C 'treat':79C 'verif':30B,91C 'verifi':51B,102C 'vulner':75C 'without':65B,116C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host NocoDB and use OAuth clients registered as confidential clients are exposed, since the flaw lets an attacker with a captured authorization code and verifier skip the client secret. Installations on a version at or after `2026.08.1`, or that use no OAuth integrations, are not affected by this flaw as described.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","nocodb","oauth","package","selfhosted"],"campaign_type":null,"search_a":"'-126276':14A,17A '-2026':13A,16A 'check':8A 'client':6A 'cve':12A,15A 'enabl':9A 'endpoint':4A 'mint':11A 'nocodb':1A 'oauth':2A 'secret':7A 'skip':5A 'token':3A,10A","search_b":"'2026.08.1':26B '60':57B 'access':54B 'attack':42B 'author':47B 'captur':46B 'client':28B,64B 'code':48B 'confidenti':63B 'day':58B 'endpoint':35B 'hold':44B 'host':23B 'mint':53B 'nocodb':18B,24B 'oauth':19B,33B 'packag':20B 'paramet':38B 'pkce':37B,50B 'refresh':59B 'secret':29B,67B 'self':22B 'self-host':21B 'skip':27B 'suppli':40B 'token':34B,55B,60B 'verif':30B 'verifi':51B 'without':65B","search_c":"'2026.08.1':70C '60':108C 'access':105C 'attack':94C 'authent':73C,87C 'author':98C 'bypass':74C 'captur':97C 'client':86C,89C,115C 'code':99C 'confidenti':85C,114C 'contain':71C 'day':109C 'hold':95C 'know':117C 'mint':104C 'nocodb':68C 'oauth-token.service.ts':77C 'omit':93C 'pkce':80C,101C 'refresh':110C 'secret':90C,119C 'skip':88C 'substitut':83C 'token':106C,111C 'treat':79C 'verif':91C 'verifi':102C 'vulner':75C 'without':116C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T10:06:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126276","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126276","severity":null,"published_at":"2026-11-13T10:17:30+00:00","modified_at":"2026-11-13T10:17:30+00:00","first_seen_at":"2026-11-13T10:47:12+00:00","fetched_at":"2026-11-13T10:47:12+00:00","note":null}],"documents":[{"id":144881,"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-4cx5-q9xx-5pgj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T10:06:18+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144882,"url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.1-client-authentication-bypass-via-oauth-token-exchange","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}