CVE-2026-126276
MEDIUM
NVD
CVSS Score
6.3
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
NocoDB before 2026.08.1 contains an authentication bypass vulnerability in oauth-token.service.ts that treats PKCE as a substitute for confidential client authentication, skipping client secret verification when omitted. Attackers holding a captured authorization code and PKCE verifier can mint access tokens and 60-day refresh tokens for a confidential client without knowing its secret.