Is CVE-2026-53928 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53928 being exploited in the wild.

How severe is CVE-2026-53928?

Medium severity, with a CVSS score of 4, published 23 June 2026.

Which products and versions are affected?

nocodb (npm) <= 0.301.3, SEMVER:introduced=0,last_affected=0.301.3.

Is there a fix for CVE-2026-53928?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-53928 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-53928?

Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53928: NocoDB insufficient session expiration in password recovery flow

Q: Which products and versions are affected?

nocodb (npm) <= 0.301.3, SEMVER:introduced=0,last_affected=0.301.3.

Q: Is there a fix for CVE-2026-53928?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-53928 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-53928?

Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53928 · Severity: medium · CVSS 4 · Published 2026-06-23

NocoDB is an open-source platform that turns databases into smart spreadsheets. A security flaw allowed stolen login credentials (refresh tokens) to remain valid even after a user reset their password using the "Forgot Password" feature. This means an attacker who previously gained access to a user's session could maintain that access indefinitely, even if the victim attempted to secure their account by changing their password.

Technologies: nocodb (npm). Vendors: npm.

Quick answers

Is CVE-2026-53928 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53928 being exploited in the wild.
How severe is CVE-2026-53928?: Medium severity, with a CVSS score of 4, published 23 June 2026.
Which products and versions are affected?: nocodb (npm) <= 0.301.3, SEMVER:introduced=0,last_affected=0.301.3.
Is there a fix for CVE-2026-53928?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-53928 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-53928?: Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

NocoDB prior to version 2026.05.1 contains a session management vulnerability (CWE-613) where the 'passwordForgot' flow fails to revoke existing refresh tokens. While 'passwordChange' and 'passwordReset' correctly call 'UserRefreshToken.deleteAllUserToken(user.id)', the 'passwordForgot' logic only rotates the 'token_version' and revokes OAuth tokens. Consequently, an attacker possessing a captured refresh cookie can continue to mint new JWT access tokens even after the victim completes the recovery process. This issue is resolved in version 2026.05.1 by ensuring all user tokens are deleted during the recovery flow.

Affected products

NocoDB NocoDB < 2026.05.1

Identifiers

CVE-2026-53928
GHSA-r989-7g3j-wjhw

Timeline

2026-06-13: advisory: GitHub Security Advisory published
2026-06-23: disclosed: CVE published to NVD

References

https://github.com/nocodb/nocodb/security/advisories/GHSA-r989-7g3j-wjhw

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.