CVE-2026-47386

Vulnerability Description

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, two concurrent token-exchange requests using the same OAuth authorization code could each mint a distinct valid (access_token, refresh_token) pair, breaking the single-use guarantee that PKCE relies on. This vulnerability is fixed in 2026.05.1.

Related Weaknesses (CWE)

CWE-362

References

https://github.com/nocodb/nocodb/security/advisories/GHSA-8m7c-hf24-5g47

FAQ

What is CVE-2026-47386?

CVE-2026-47386 is a documented vulnerability. NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, two concurrent token-exchange requests using the same OAuth authorization code could each mint a distinct valid (access_t...

How severe is CVE-2026-47386?

CVSS scoring is not yet available for CVE-2026-47386. Check NVD for updates.

Is there a patch for CVE-2026-47386?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.