| Title | nocodb <=2026.07.0 Observable Response Discrepancy |
|---|
| Description | AuthService.validateUser() branches on whether the located user record has a salt value. A user provisioned by administrator invitation, or created through an OAuth provider, has salt = NULL because no local password has ever been set. For those accounts the sign-in endpoint returns HTTP 400 with the message:
If invited, sign up via the email link; otherwise, use forgot password or contact the super admin.
whereas an address with no account at all returns HTTP 400 Invalid credentials.
The response body therefore discloses three distinguishable account states to an unauthenticated caller:
Account state Response message
Exists, local password set Invalid credentials
Exists, invited or OAuth-provisioned (salt IS NULL) If invited, sign up via the email link; ...
Does not exist Invalid credentials |
|---|
| Source | ⚠️ https://github.com/nocodb/nocodb/issues/14687 |
|---|
| User | ZAST.AI (UID 87884) |
|---|
| Submission | 09/29/2026 10:54 (26 days ago) |
|---|
| Moderation | 10/25/2026 10:23 (26 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 426190 [NocoDB up to 2026.07.0 Sign-in Endpoint AuthService.validateUser salt information disclosure] |
|---|
| Points | 20 |
|---|