---
id: "CVE-2026-28396"
page: "https://infrastack.ai/live/CVE-2026-28396"
kind: "vulnerability"
aliases: ["CVE-2026-28396", "GHSA-x4vh-j75g-268g"]
title: "NocoDB's Refresh Tokens Not Revoked on Password Reset"
severity: "medium"
cvss: 6.5
epss: 0.0021
exploited: false
status: "open"
category: "package"
products: [{"name": "nocodb", "fixed": ["0.301.3"], "affected": "<= 0.301.2", "ecosystem": "npm"}, {"name": "nocodb", "fixed": ["0.301.3"], "affected": "< 0.301.3", "ecosystem": "vendor"}]
ecosystems: ["npm", "vendor"]
tags: ["cwe-613", "nocodb", "node", "package", "self-hosted"]
not_affected_if: ["no-stolen-refresh-tokens", "version-0.301.3-or-later"]
published_at: "2026-03-02T17:16:34+00:00"
first_seen_at: "2026-11-05T22:57:14+00:00"
updated_at: "2026-11-05T23:15:56+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-x4vh-j75g-268g", "first_seen_at": "2026-11-05T22:57:14+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28396", "first_seen_at": "2026-11-05T23:15:56+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.0021, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28396"}]
---

# NocoDB's Refresh Tokens Not Revoked on Password Reset

Link for people: https://infrastack.ai/live/CVE-2026-28396 (this .md is for agents)

NocoDB's password reset invalidated access JWTs but did not delete existing refresh tokens. An attacker holding a previously stolen refresh token can keep minting valid JWTs after the victim resets their password, until that token expires.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:nocodb affected <= 0.301.2 fixed 0.301.3
- vendor:nocodb affected < 0.301.3 fixed 0.301.3

## How to check

- Check the installed `nocodb` package version in your project, for example with `npm ls nocodb`.
- Look for a `passwordReset` path in `users.service.ts` that does not call `UserRefreshToken.deleteAllUserToken()`.

## Fix

- `nocodb` moves to `0.301.3` or later.

## Timeline

- 2026-11-05T22:57:14+00:00 ghsa https://github.com/advisories/GHSA-x4vh-j75g-268g
- 2026-11-05T23:15:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-28396

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/nocodb/nocodb/security-advisories/GHSA-x4vh-j75g-268g
- [advisory] Maintainer's advisory: github.com https://github.com/nocodb/nocodb/security/advisories/GHSA-x4vh-j75g-268g
- [fix] Release: github.com https://github.com/nocodb/nocodb/releases/tag/0.301.3
- [fix] Patch: github.com https://github.com/nocodb/nocodb/commit/dfbe836577354ba780563a5cf8cb50bfc61a203e

## From the sources

### Summary
The password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password.

### Details
`passwordReset()` in `users.service.ts` updated `token_version` (invalidating JWTs) but did not call `UserRefreshToken.deleteAllUserToken()`. The `refreshToken()` method only checked token existence, not `token_version`. Both `passwordChange()` and `signOut()` correctly deleted all refresh tokens.

### Impact
An attacker who previously obtained a refresh token retains access after password reset until the token expires.

### Credit
This issue was reported by [@bugbunny-research](https://github.com/bugbunny-research) (bugbunny.ai).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_