The vulnerability arises because the password reset flow does not revoke existing refresh tokens, permitting an attacker who already holds a stolen refresh token to keep minting valid JWTs even after the user changes their password. This flaw creates a persistent, unauthorized access path without requiring further credentials or exploits. It is categorized as CWE‑613, a weakness in credential management.

The flaw affects all installations of NocoDB running versions older than 0.301.3, including the latest released versions prior to the patch. Users of any earlier releases are potentially exposed.

The CVSS score of 4.9 indicates moderate severity. EPSS is reported as less than 1 %, suggesting a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires prior theft of a refresh token; no additional privileges or network access are needed. Once a token is compromised, an attacker can continue generating valid JWTs indefinitely until the password is changed and the token is revoked by the patch.