| 标题 | nocodb < 2026.08.1 Race Condition |
|---|
| 描述 | users.service.ts handled a reset by reading the user row keyed on reset_password_token, checking the expiry and the account's auth provider, hashing the submitted password, and only then issuing an unconditional update that cleared the token. The read and the clearing write were neither wrapped in a transaction nor expressed as a conditional update, so nothing tied the clear to the row state that had been validated. Two deliberately slow bcrypt operations, salt generation and hashing at cost factor 10, sat between the two, holding the window open long enough that a batch of simultaneously released requests all passed validation before any of them cleared the token; each then went on to write a password, emit a password-reset audit event and return success. Sequential replay of a consumed token was rejected correctly — the defect was strictly concurrent. |
|---|
| 来源 | ⚠️ https://github.com/nocodb/nocodb/issues/14684 |
|---|
| 用户 | ZAST.AI (UID 87884) |
|---|
| 提交 | 2026-09-29 10時43分 (1 月前) |
|---|
| 管理 | 2026-10-25 10時23分 (26 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 426187 [NocoDB 直到 2026.08.0 Password-Reset Flow users.service.ts 竞争条件] |
|---|
| 积分 | 20 |
|---|