CVE-2026-126276

CVSS 8.2 (high) · published 2026-11-13

NocoDB before 2026.08.1 contains an authentication bypass vulnerability in oauth-token.service.ts that treats PKCE as a substitute for confidential client authentication, skipping client secret verification when omitted. Attackers holding a captured authorization code and PKCE verifier can mint access tokens and 60-day refresh tokens for a confidential client without knowing its secret.

Weakness: CWE-287

Source: NVD CVE-2026-126276

References

• https://github.com/nocodb/nocodb/security/advisories/GHSA-4cx5-q9xx-5pgj
• https://www.vulncheck.com/advisories/nocodb-before-2026.08.1-client-authentication-bypass-via-oauth-token-exchange

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.