NocoDB: OAuth Authorization Code Race Condition
Summary
Two concurrent token-exchange requests using the same OAuth authorization code could
each mint a distinct valid (access_token, refresh_token) pair, breaking the
single-use guarantee that PKCE relies on.
Details
The token-exchange flow read is_used and called markAsUsed as an unconditional
update at the end of the path. A new OAuthAuthorizationCode.claimByCode method now
performs an atomic compare-and-swap (WHERE code = ? AND is_used = false) and is
called immediately before OAuthToken.insert, after redirect-URI, PKCE, and client
authentication have all succeeded. Only the first concurrent caller's UPDATE wins;
the rest see invalid_grant: Authorization code has already been used.
Impact
An attacker who has observed an authorization code and the corresponding PKCE verifier (for example through a malicious OAuth-aware client or by racing a real exchange) could obtain a long-lived refresh token in addition to the legitimate one.
Credit
This issue was reported by @eddieran.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | nocodb | < 2026.05.1 | 2026.05.1 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-362- Platform
- npm
- Package
nocodb- Disclosed
- 05.06.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-8m7c-hf24-5g47 - CC BY 4.0
Vulnerability history: nocodb
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 54
- First → latest
- 06.2022 06.2026
- Without a fix
- 13
- Exploited in attacks
- 0
Severity breakdown
- High 7
- Medium 41
- Low 6
Disclosures per year
- 2022: 5
- 2023: 2
- 2024: 3
- 2025: 1
- 2026: 43
-
NocoDB: OAuth Authorization Code Race Condition this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.