| 标题 | nocodb <=2026.07.0 Observable Response Discrepancy |
|---|
| 描述 | AuthService.validateUser() branches on whether the located user record has a salt value. A user provisioned by administrator invitation, or created through an OAuth provider, has salt = NULL because no local password has ever been set. For those accounts the sign-in endpoint returns HTTP 400 with the message:
If invited, sign up via the email link; otherwise, use forgot password or contact the super admin.
whereas an address with no account at all returns HTTP 400 Invalid credentials.
The response body therefore discloses three distinguishable account states to an unauthenticated caller:
Account state Response message
Exists, local password set Invalid credentials
Exists, invited or OAuth-provisioned (salt IS NULL) If invited, sign up via the email link; ...
Does not exist Invalid credentials |
|---|
| 来源 | ⚠️ https://github.com/nocodb/nocodb/issues/14687 |
|---|
| 用户 | ZAST.AI (UID 87884) |
|---|
| 提交 | 2026-09-29 10時54分 (1 月前) |
|---|
| 管理 | 2026-10-25 10時23分 (26 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 426190 [NocoDB 直到 2026.07.0 Sign-in Endpoint AuthService.validateUser salt 信息公开] |
|---|
| 积分 | 20 |
|---|