NocoDB, a spreadsheet‑style database platform, has a race condition in its token‑exchange endpoint that allows two concurrent requests using the same OAuth authorization code to each generate a distinct valid access_token and refresh_token pair. This flaw, identified as CWE‑362, breaks the single‑use guarantee expected by PKCE and permits the creation of multiple usable tokens from one authorization code.

All NocoDB instances running versions prior to 2026.05.1 are affected; the issue is fixed in version 2026.05.1.

The CVSS score of 6.3 classifies the vulnerability as moderate. EPSS information is not available and the flaw is not listed in the CISA KEV catalog. An attacker can exploit the race condition by issuing two simultaneous token‑exchange requests that reuse the same authorization code; no special permissions are required beyond the ability to connect to the NocoDB service.