# CVE-2026-28396: NocoDB's Refresh Tokens Not Revoked on Password Reset

Source: https://junglewise.ai/threats/cve-2026-28396-nocodb-refresh-token-not-revoked-on-password-reset  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-28396 · Severity: medium · CVSS 4 · Published 2026-03-02

NocoDB is a popular open-source database management and collaboration platform. When a user resets their password, the application fails to revoke previously issued refresh tokens, allowing an attacker who previously stole a refresh token to continue accessing the account and generating valid authentication tokens until that stolen token naturally expires.

Technologies: [nocodb (npm)](https://junglewise.ai/threats/technologies/nocodb). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-28396 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-28396 being exploited in the wild.

**How severe is CVE-2026-28396?** Medium severity, with a CVSS score of 4, published 2 March 2026.

**Which products and versions are affected?** nocodb (npm) <= 0.301.2, SEMVER:introduced=0,fixed=0.301.3.

**Is there a fix for CVE-2026-28396?** Yes. nocodb (npm): upgrade to 0.301.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-28396 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-28396?** Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nocodb (npm): upgrade to 0.301.3 or later

  ```sh
  npm install nocodb@0.301.3
  ```


## Technical details

The vulnerability is a session expiration weakness (CWE-613) in NocoDB's password reset flow. The passwordReset() function in users.service.ts increments the token_version field (which invalidates JWTs), but fails to call UserRefreshToken.deleteAllUserToken() to revoke refresh tokens. The refreshToken() method only validates token existence, not token_version compatibility. In contrast, passwordChange() and signOut() correctly delete all refresh tokens. An attacker with a previously stolen refresh token can exploit this to mint new valid JWTs after the victim resets their password, maintaining unauthorized access until the stolen refresh token's natural expiration. The patch is available in version 0.301.3.

## Affected products

- NocoDB NocoDB <= 0.301.2

## Identifiers

- CVE-2026-28396
- GHSA-x4vh-j75g-268g

## Timeline

- 2026-03-02: disclosed: Advisory published
- 2026-03-02: patched: Fix released in version 0.301.3

## References

- [https://github.com/nocodb/nocodb/security/advisories/GHSA-x4vh-j75g-268g](https://github.com/nocodb/nocodb/security/advisories/GHSA-x4vh-j75g-268g)

## Related threats

- [NocoDB SSRF in spreadsheet-import endpoint](https://junglewise.ai/threats/cve-2026-53931-nocodb-ssrf-in-spreadsheet-import-endpoint)
- [NocoDB SSRF in base-migration endpoint](https://junglewise.ai/threats/cve-2026-53930-nocodb-ssrf-in-base-migration-endpoint)
- [NocoDB stored cross-site scripting in secure attachments](https://junglewise.ai/threats/cve-2026-53929-nocodb-stored-cross-site-scripting-in-secure-attachments)
- [NocoDB insufficient session expiration in password recovery flow](https://junglewise.ai/threats/cve-2026-53928-nocodb-insufficient-session-expiration-in-password-recovery-flow)
- [NocoDB SSRF in spreadsheet-fetch endpoint](https://junglewise.ai/threats/cve-2026-53927-nocodb-ssrf-in-spreadsheet-fetch-endpoint)