| 제목 | nocodb <=2026.07.0 Observable Response Discrepancy |
|---|
| 설명 | AuthService.validateUser() branches on whether the located user record has a salt value. A user provisioned by administrator invitation, or created through an OAuth provider, has salt = NULL because no local password has ever been set. For those accounts the sign-in endpoint returns HTTP 400 with the message:
If invited, sign up via the email link; otherwise, use forgot password or contact the super admin.
whereas an address with no account at all returns HTTP 400 Invalid credentials.
The response body therefore discloses three distinguishable account states to an unauthenticated caller:
Account state Response message
Exists, local password set Invalid credentials
Exists, invited or OAuth-provisioned (salt IS NULL) If invited, sign up via the email link; ...
Does not exist Invalid credentials |
|---|
| 원천 | ⚠️ https://github.com/nocodb/nocodb/issues/14687 |
|---|
| 사용자 | ZAST.AI (UID 87884) |
|---|
| 제출 | 2026. 09. 29. AM 10:54 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 25. AM 10:23 (26 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 426190 [NocoDB 까지 2026.07.0 Sign-in Endpoint AuthService.validateUser salt 정보 공개] |
|---|
| 포인트들 | 20 |
|---|