NocoDB Password Reset Vulnerability Allows Token Reuse

A vulnerability in NocoDB's password reset process prior to version 0.301.3 allowed for the continued use of refresh tokens after a password was changed. The issue arose because the password reset function did not invalidate existing refresh tokens, leaving a window for attackers with stolen tokens to generate valid JSON Web Tokens (JWTs) even after the victim had reset their password.

Impact

This vulnerability could lead to unauthorized access, as it allowed attackers to maintain access through stolen refresh tokens even after a password reset.

Remediation

Users can upgrade to NocoDB version 0.301.3 or later, where this vulnerability has been patched.