js · nocodbHeads-up
NocoDB OAuth tokens no longer persist after password change
OAuth access and refresh tokens are now revoked when a user changes, resets, or recovers their password.
What changed
OAuth access and refresh tokens are now revoked when a user changes, resets, or recovers their password. Previously, the revokeAllOAuthTokensByUser function was an empty stub, leaving tokens valid after password changes.
Who it affects
Users of NocoDB who rely on password change, forgot, or reset flows to invalidate OAuth tokens issued to attackers.
What to do today
Update NocoDB to the latest version that includes the fix for this advisory.
The trail
Collected→
Audited→
Written→
Published
Source
GitHub Advisory · nocodb