js · nocodbHeads-up
NocoDB: Timing-safe password verification for shared views
The shared-view password check in View.
What changed
The shared-view password check in View.ts and the EE dashboard model's verifyPassword now use crypto.timingSafeEqual and a same-length dummy compare on the length-mismatch path, replacing the legacy strict-equality (===) comparison that leaked password length and per-character prefix through response timing.
Who it affects
Users of NocoDB with shared views that have passwords predating the bcrypt migration, and any network-positioned attacker who can time shared-view authentication responses.
What to do today
Update NocoDB to the patched version to eliminate the timing side-channel vulnerability in shared-view password verification.
The trail
Collected→
Audited→
Written→
Published
Source
GitHub Advisory · nocodb