| 제목 | nocodb < 2026.08.1 Race Condition |
|---|
| 설명 | users.service.ts handled a reset by reading the user row keyed on reset_password_token, checking the expiry and the account's auth provider, hashing the submitted password, and only then issuing an unconditional update that cleared the token. The read and the clearing write were neither wrapped in a transaction nor expressed as a conditional update, so nothing tied the clear to the row state that had been validated. Two deliberately slow bcrypt operations, salt generation and hashing at cost factor 10, sat between the two, holding the window open long enough that a batch of simultaneously released requests all passed validation before any of them cleared the token; each then went on to write a password, emit a password-reset audit event and return success. Sequential replay of a consumed token was rejected correctly — the defect was strictly concurrent. |
|---|
| 원천 | ⚠️ https://github.com/nocodb/nocodb/issues/14684 |
|---|
| 사용자 | ZAST.AI (UID 87884) |
|---|
| 제출 | 2026. 09. 29. AM 10:43 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 25. AM 10:23 (26 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 426187 [NocoDB 까지 2026.08.0 Password-Reset Flow users.service.ts 경쟁 조건] |
|---|
| 포인트들 | 20 |
|---|