# CVE-2026-53928: NocoDB insufficient session expiration in password recovery flow

Source: https://junglewise.ai/threats/cve-2026-53928-nocodb-insufficient-session-expiration-in-password-recovery-flow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-53928 · Severity: medium · CVSS 4 · Published 2026-06-23

NocoDB is an open-source platform that turns databases into smart spreadsheets. A security flaw allowed stolen login credentials (refresh tokens) to remain valid even after a user reset their password using the "Forgot Password" feature. This means an attacker who previously gained access to a user's session could maintain that access indefinitely, even if the victim attempted to secure their account by changing their password.

Technologies: [nocodb (npm)](https://junglewise.ai/threats/technologies/nocodb). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-53928 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53928 being exploited in the wild.

**How severe is CVE-2026-53928?** Medium severity, with a CVSS score of 4, published 23 June 2026.

**Which products and versions are affected?** nocodb (npm) <= 0.301.3, SEMVER:introduced=0,last_affected=0.301.3.

**Is there a fix for CVE-2026-53928?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-53928 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-53928?** Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

NocoDB prior to version 2026.05.1 contains a session management vulnerability (CWE-613) where the 'passwordForgot' flow fails to revoke existing refresh tokens. While 'passwordChange' and 'passwordReset' correctly call 'UserRefreshToken.deleteAllUserToken(user.id)', the 'passwordForgot' logic only rotates the 'token_version' and revokes OAuth tokens. Consequently, an attacker possessing a captured refresh cookie can continue to mint new JWT access tokens even after the victim completes the recovery process. This issue is resolved in version 2026.05.1 by ensuring all user tokens are deleted during the recovery flow.

## Affected products

- NocoDB NocoDB < 2026.05.1

## Identifiers

- CVE-2026-53928
- GHSA-r989-7g3j-wjhw

## Timeline

- 2026-06-13: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD

## References

- [https://github.com/nocodb/nocodb/security/advisories/GHSA-r989-7g3j-wjhw](https://github.com/nocodb/nocodb/security/advisories/GHSA-r989-7g3j-wjhw)

## Related threats

- [NocoDB SSRF in spreadsheet-import endpoint](https://junglewise.ai/threats/cve-2026-53931-nocodb-ssrf-in-spreadsheet-import-endpoint)
- [NocoDB SSRF in base-migration endpoint](https://junglewise.ai/threats/cve-2026-53930-nocodb-ssrf-in-base-migration-endpoint)
- [NocoDB stored cross-site scripting in secure attachments](https://junglewise.ai/threats/cve-2026-53929-nocodb-stored-cross-site-scripting-in-secure-attachments)
- [NocoDB SSRF in spreadsheet-fetch endpoint](https://junglewise.ai/threats/cve-2026-53927-nocodb-ssrf-in-spreadsheet-fetch-endpoint)
- [NocoDB insufficient session expiration in OAuth token revocation](https://junglewise.ai/threats/cve-2026-53926-nocodb-insufficient-session-expiration-in-oauth-token-revocation)