| शीर्षक | nocodb <=2026.07.0 Observable Response Discrepancy |
|---|
| विवरण | AuthService.validateUser() branches on whether the located user record has a salt value. A user provisioned by administrator invitation, or created through an OAuth provider, has salt = NULL because no local password has ever been set. For those accounts the sign-in endpoint returns HTTP 400 with the message:
If invited, sign up via the email link; otherwise, use forgot password or contact the super admin.
whereas an address with no account at all returns HTTP 400 Invalid credentials.
The response body therefore discloses three distinguishable account states to an unauthenticated caller:
Account state Response message
Exists, local password set Invalid credentials
Exists, invited or OAuth-provisioned (salt IS NULL) If invited, sign up via the email link; ...
Does not exist Invalid credentials |
|---|
| स्रोत | ⚠️ https://github.com/nocodb/nocodb/issues/14687 |
|---|
| उपयोगकर्ता | ZAST.AI (UID 87884) |
|---|
| सबमिशन | 29/09/2026 10:54 AM (1 महीना पहले) |
|---|
| संयम | 25/10/2026 10:23 AM (26 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 426190 [NocoDB तक 2026.07.0 Sign-in Endpoint AuthService.validateUser salt सूचना का प्रकटीकरण] |
|---|
| अंक | 20 |
|---|