# CVE-2026-53926: NocoDB insufficient session expiration in OAuth token revocation

Source: https://junglewise.ai/threats/cve-2026-53926-nocodb-insufficient-session-expiration-in-oauth-token-revocation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-53926 · Severity: medium · CVSS 4 · Published 2026-06-23

NocoDB, a platform for building databases as spreadsheets, failed to properly cancel active login sessions when a user changed or reset their password. This means that if an attacker had already gained access to an account via an OAuth token, they would remain logged in even after the legitimate user updated their security credentials. This could lead to unauthorized data access and persistent account compromise despite the user's attempts to secure their account.

Technologies: [nocodb (npm)](https://junglewise.ai/threats/technologies/nocodb). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-53926 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53926 being exploited in the wild.

**How severe is CVE-2026-53926?** Medium severity, with a CVSS score of 4, published 23 June 2026.

**Which products and versions are affected?** nocodb (npm) ECOSYSTEM:introduced=0,fixed=2026.05.1.

**Is there a fix for CVE-2026-53926?** Yes. nocodb (npm): upgrade to 2026.05.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53926 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-53926?** Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nocodb (npm): upgrade to 2026.05.1 or later

  ```sh
  npm install nocodb@2026.05.1
  ```


## Technical details

A vulnerability exists in NocoDB where the 'revokeAllOAuthTokensByUser' function in the users service was implemented as an empty stub. Consequently, when security events such as passwordChange, passwordForgot, or passwordReset were triggered, existing OAuth access and refresh tokens remained valid. An attacker with a previously issued OAuth grant could maintain persistent access to the user's account even after a password reset. The fix, introduced in version 2026.05.1, implements proper delegation to 'OAuthToken.revokeAllByUser' to delete relevant database rows and invalidate authentication caches.

## Affected products

- nocodb nocodb < 2026.05.1

## Identifiers

- CVE-2026-53926
- GHSA-g72g-r7m4-9x4g

## Timeline

- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD

## References

- [https://github.com/nocodb/nocodb/security/advisories/GHSA-g72g-r7m4-9x4g](https://github.com/nocodb/nocodb/security/advisories/GHSA-g72g-r7m4-9x4g)

## Related threats

- [NocoDB SSRF in spreadsheet-import endpoint](https://junglewise.ai/threats/cve-2026-53931-nocodb-ssrf-in-spreadsheet-import-endpoint)
- [NocoDB SSRF in base-migration endpoint](https://junglewise.ai/threats/cve-2026-53930-nocodb-ssrf-in-base-migration-endpoint)
- [NocoDB stored cross-site scripting in secure attachments](https://junglewise.ai/threats/cve-2026-53929-nocodb-stored-cross-site-scripting-in-secure-attachments)
- [NocoDB insufficient session expiration in password recovery flow](https://junglewise.ai/threats/cve-2026-53928-nocodb-insufficient-session-expiration-in-password-recovery-flow)
- [NocoDB SSRF in spreadsheet-fetch endpoint](https://junglewise.ai/threats/cve-2026-53927-nocodb-ssrf-in-spreadsheet-fetch-endpoint)