Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, two concurrent token-exchange requests using the same OAuth authorization code could each mint a distinct valid (access_token, refresh_token) pair, breaking the single-use guarantee that PKCE relies on. This vulnerability is fixed in 2026.05.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-47386 NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, two concurrent token-exchange requests using the same OAuth authorization code could ea… https://www.cve.org/CVERecord?id=CVE-2026-47386
Post summary
The CVE details a race condition in NocoDB’s token exchange process where concurrent requests using the same OAuth code can cause a flaw before version 2026.05.1.
🚨*CVE* CVE-2026-47386 NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, two concurrent token-exchange requests using the same OAuth authorization code could ea… https://www.cve.org/CVERecord?id=CVE-2026-47386 ----- Traducción: CVE-2026-47386 Noc… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-47386 for NocoDB, providing a brief technical detail and a link to the CVE record, with no mention of exploits, patches, or active attacks.