CVE-2026-47386
NocoDB: OAuth Authorization Code Race Condition
Description
### Summary Two concurrent token-exchange requests using the same OAuth authorization code could each mint a distinct valid `(access_token, refresh_token)` pair, breaking the single-use guarantee that PKCE relies on. ### Details The token-exchange flow read `is_used` and called `markAsUsed` as an unconditional update at the end of the path. A new `OAuthAuthorizationCode.claimByCode` method now performs an atomic compare-and-swap (`WHERE code = ? AND is_used = false`) and is called immediately before `OAuthToken.insert`, after redirect-URI, PKCE, and client authentication have all succeeded. Only the first concurrent caller's `UPDATE` wins; the rest see `invalid_grant: Authorization code has already been used`. ### Impact An attacker who has observed an authorization code and the corresponding PKCE verifier (for example through a malicious OAuth-aware client or by racing a real exchange) could obtain a long-lived refresh token in addition to the legitimate one. ### Credit This issue was reported by [@eddieran](https://github.com/eddieran).
How to fix CVE-2026-47386
To remediate CVE-2026-47386, upgrade the affected package to a fixed version below.
- —upgrade to 2026.05.1 or later
Is CVE-2026-47386 being exploited?
No exploitation signal available. Neither CISA KEV nor a current EPSS score has been published for CVE-2026-47386.
Affected packages (1)
- from 0, < 2026.05.1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |