Executive brief
NocoDB is a popular open-source database management and collaboration platform used as an alternative to Airtable. This vulnerability allows an attacker to craft a phishing attack by redirecting authenticated users to malicious external websites after they successfully log in, enabling credential theft through social engineering. The flaw does not directly expose user data or allow unauthorized access, but it undermines the integrity of the login process and increases the risk of account compromise.
Technical details
This open redirect (CWE-601) vulnerability exists in NocoDB's redirect logic, specifically in a helper function that uses an overly permissive regular expression (/^(https?:)?\/\// ) to validate URLs. This regex accepts any HTTP(S) URL or protocol-relative URL without restricting allowed domains or origins. When the continueAfterSignIn query parameter matches this pattern, the application unconditionally performs external navigation via navigateTo() without allowlist validation. An attacker can craft a malicious login URL (e.g., https://victim-nocodb.example/#/signin?continueAfterSignIn=https://evil-phishing.com/fake-login) and distribute it via phishing. After a victim authenticates with legitimate credentials, they are automatically redirected to the attacker's site, which can display a fake error and request credential re-entry. The vulnerability requires user interaction (clicking the malicious link and logging in) but affects all NocoDB versions prior to 0.265.1, with a patch available in version 0.301.0.
Affected products
- NocoDB NocoDB < 0.265.1; patched in 0.301.0
Timeline
- 2026-01-28: disclosed: Vulnerability disclosed via GHSA-3hmw-8mw3-rmpj
- 2026-01-28: patched: Patch released in version 0.301.0