### Summary A stolen refresh token survived a password-forgot flow and could be used to mint fresh JWTs even after the user reset their password. ### Details `passwordChange` and `passwordReset` deleted the user's refresh tokens, but `passwordForgot` only rotated `token_version` and revoked OAuth tokens — it did not call `UserRefreshToken.deleteAllUserToken(user.id)`. An attacker holding a captured refresh cookie could still exchange it for a new access token after the victim triggered the recovery flow. ### Impact Persistent unauthorized access after password recovery. Once a refresh token leaks, the documented "Forgot password" recovery flow did not in fact revoke the attacker's session. ### Credit This issue was reported by [@bugbunny-research](https://github.com/bugbunny-research).
Monitor this advisory for an available fix and review any installs of the affected package.
Local check
hol-guard supply-chain scanNocoDB: Refresh Tokens Persist Through Password Recovery affects nocodb (npm). Severity is medium. ### Summary A stolen refresh token survived a password-forgot flow and could be used to mint fresh JWTs even after the user reset their password. ### Details `passwordChange` and `passwordReset` deleted the user's refresh tokens, but `passwordForgot` only rotated `token_version` and revoked OAuth tokens — it did not call `UserRefreshToken.deleteAllUserToken(user.id)`. An attacker holding a captured refresh cookie could still exchange it for a new access token after the victim triggered the recovery flow. ### Impact Persistent unauthorized access after password recovery. Once a refresh token leaks, the documented "Forgot password" recovery flow did not in fact revoke the attacker's session. ### Credit This issue was reported by [@bugbunny-research](https://github.com/bugbunny-research).
AI coding agents often install or upgrade packages automatically in npm. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
### Summary A stolen refresh token survived a password-forgot flow and could be used to mint fresh JWTs even after the user reset their password. ### Details `passwordChange` and `passwordReset` deleted the user's refresh tokens, but `passwordForgot` only rotated `token_version` and revoked OAuth tokens — it did not call `UserRefreshToken.deleteAllUserToken(user.id)`. An attacker holding a captured refresh cookie could still exchange it for a new access token after the victim triggered the recovery flow. ### Impact Persistent unauthorized access after password recovery. Once a refresh token leaks, the documented "Forgot password" recovery flow did not in fact revoke the attacker's session. ### Credit This issue was reported by [@bugbunny-research](https://github.com/bugbunny-research).
Monitor this advisory for an available fix and review any installs of the affected package.
Local check
hol-guard supply-chain scanNocoDB: Refresh Tokens Persist Through Password Recovery affects nocodb (npm). Severity is medium. ### Summary A stolen refresh token survived a password-forgot flow and could be used to mint fresh JWTs even after the user reset their password. ### Details `passwordChange` and `passwordReset` deleted the user's refresh tokens, but `passwordForgot` only rotated `token_version` and revoked OAuth tokens — it did not call `UserRefreshToken.deleteAllUserToken(user.id)`. An attacker holding a captured refresh cookie could still exchange it for a new access token after the victim triggered the recovery flow. ### Impact Persistent unauthorized access after password recovery. Once a refresh token leaks, the documented "Forgot password" recovery flow did not in fact revoke the attacker's session. ### Credit This issue was reported by [@bugbunny-research](https://github.com/bugbunny-research).
AI coding agents often install or upgrade packages automatically in npm. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| nocodbnpm |
|---|
| <=0.301.3 |
| Not reported |
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard| nocodbnpm |
|---|
| <=0.301.3 |
| Not reported |
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard