Executive brief
NocoDB, a platform for building databases as spreadsheets, was found to have a security flaw in its login process. An attacker could determine if a specific email address is registered with the service by measuring how long the system takes to respond to login attempts. This information could be used to target specific users for further attacks or to map out a company's user base.
Technical details
A timing side-channel vulnerability (CWE-208) exists in NocoDB's authentication service. Prior to version 2026.04.1, the application would return immediately if an email address was not found, but would perform a computationally expensive password hash comparison if the email existed. This discrepancy allows a network-based attacker to enumerate valid users by timing the server's response to unauthenticated sign-in requests. The fix introduces a dummy bcrypt comparison for unknown users to ensure consistent response times. Rate limiting for this endpoint is only available in the Enterprise edition.
Affected products
- nocodb nocodb < 2026.04.1
Timeline
- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD