CVE-2026-24768

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24768", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-26T21:06:47.868Z", "datePublished": "2026-01-28T20:32:03.500Z", "dateUpdated": "2026-01-29T18:01:18.446Z"}, "containers": {"cna": {"title": "NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter", "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P", "version": "4.0"}}], "references": [{"name": "https://github.com/nocodb/nocodb/security/advisories/GHSA-3hmw-8mw3-rmpj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-3hmw-8mw3-rmpj"}], "affected": [{"vendor": "nocodb", "product": "nocodb", "versions": [{"version": "< 0.301.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-28T20:32:03.500Z"}, "descriptions": [{"lang": "en", "value": "NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an unvalidated redirect (open redirect) vulnerability exists in NocoDB\u2019s login flow due to missing validation of the `continueAfterSignIn` parameter. During authentication, NocoDB processes a user-controlled redirect value and conditionally performs client-side navigation without enforcing any restrictions on the destination\u2019s origin, domain or protocol. This allows attackers to redirect authenticated users to arbitrary external websites after login. This vulnerability enables phishing attacks by leveraging user trust in the legitimate NocoDB login flow. While it does not directly expose credentials or bypass authentication, it increases the likelihood of credential theft through social engineering. The issue does not allow arbitrary code execution or privilege escalation, but it undermines authentication integrity. Version 0.301.0 fixes the issue."}], "source": {"advisory": "GHSA-3hmw-8mw3-rmpj", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-29T16:03:11.413284Z", "id": "CVE-2026-24768", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T18:01:18.446Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24768", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-29T16:03:11.413284Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T16:03:14.218Z"}}], "cna": {"title": "NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter", "source": {"advisory": "GHSA-3hmw-8mw3-rmpj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "nocodb", "product": "nocodb", "versions": [{"status": "affected", "version": "< 0.301.0"}]}], "references": [{"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-3hmw-8mw3-rmpj", "name": "https://github.com/nocodb/nocodb/security/advisories/GHSA-3hmw-8mw3-rmpj", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an unvalidated redirect (open redirect) vulnerability exists in NocoDB\u2019s login flow due to missing validation of the `continueAfterSignIn` parameter. During authentication, NocoDB processes a user-controlled redirect value and conditionally performs client-side navigation without enforcing any restrictions on the destination\u2019s origin, domain or protocol. This allows attackers to redirect authenticated users to arbitrary external websites after login. This vulnerability enables phishing attacks by leveraging user trust in the legitimate NocoDB login flow. While it does not directly expose credentials or bypass authentication, it increases the likelihood of credential theft through social engineering. The issue does not allow arbitrary code execution or privilege escalation, but it undermines authentication integrity. Version 0.301.0 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-28T20:32:03.500Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24768", "state": "PUBLISHED", "dateUpdated": "2026-01-29T18:01:18.446Z", "dateReserved": "2026-01-26T21:06:47.868Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-28T20:32:03.500Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nocodb", "vendor": "nocodb", "versions": [{"status": "affected", "version": "< 0.301.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E17808E-7686-4232-8ADC-D8C548B7F9F0", "versionEndExcluding": "0.301.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an unvalidated redirect (open redirect) vulnerability exists in NocoDB\u2019s login flow due to missing validation of the `continueAfterSignIn` parameter. During authentication, NocoDB processes a user-controlled redirect value and conditionally performs client-side navigation without enforcing any restrictions on the destination\u2019s origin, domain or protocol. This allows attackers to redirect authenticated users to arbitrary external websites after login. This vulnerability enables phishing attacks by leveraging user trust in the legitimate NocoDB login flow. While it does not directly expose credentials or bypass authentication, it increases the likelihood of credential theft through social engineering. The issue does not allow arbitrary code execution or privilege escalation, but it undermines authentication integrity. Version 0.301.0 fixes the issue."}, {"lang": "es", "value": "NocoDB es un software para construir bases de datos como hojas de c\u00e1lculo. Antes de la versi\u00f3n 0.301.0, existe una vulnerabilidad de redirecci\u00f3n no validada (redirecci\u00f3n abierta) en el flujo de inicio de sesi\u00f3n de NocoDB debido a la falta de validaci\u00f3n del par\u00e1metro `continueAfterSignIn`. Durante la autenticaci\u00f3n, NocoDB procesa un valor de redirecci\u00f3n controlado por el usuario y realiza condicionalmente una navegaci\u00f3n del lado del cliente sin aplicar ninguna restricci\u00f3n sobre el origen, dominio o protocolo del destino. Esto permite a los atacantes redirigir a usuarios autenticados a sitios web externos arbitrarios despu\u00e9s del inicio de sesi\u00f3n. Esta vulnerabilidad permite ataques de phishing aprovechando la confianza del usuario en el flujo de inicio de sesi\u00f3n leg\u00edtimo de NocoDB. Si bien no expone directamente credenciales ni omite la autenticaci\u00f3n, aumenta la probabilidad de robo de credenciales a trav\u00e9s de ingenier\u00eda social. El problema no permite la ejecuci\u00f3n de c\u00f3digo arbitrario ni la escalada de privilegios, pero socava la integridad de la autenticaci\u00f3n. La versi\u00f3n 0.301.0 corrige el problema."}], "id": "CVE-2026-24768", "lastModified": "2026-06-17T10:23:33.623", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24768", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-29T16:03:11.413284Z", "version": "2.0.3"}}]}, "published": "2026-01-28T21:16:12.430", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-3hmw-8mw3-rmpj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T01:39:06.928626+00:00", "value": {"mitigation_remediation": ["Upgrade NocoDB to version 0.301.0 or later. ", "If an immediate upgrade is not feasible, configure the application to reject or validate redirect destinations in the continueAfterSignIn parameter. ", "Educate users about the risk of unexpected redirects post\u2011login and verify URLs before interacting with external sites."], "summary": {"action": "Patch Immediately", "impact": "Credential theft via phishing through an open redirect"}, "threat_synthesis": {"affected_systems": "Affected systems include the NocoDB application for all versions earlier than 0.301.0. The vulnerability is present in any deployment of NocoDB that includes the unpatched login flow, regardless of the hosting environment.", "description_and_impact": "The vulnerability is an unvalidated redirect in NocoDB\u2019s login flow caused by the lack of verification for the continueAfterSignIn parameter. During authentication, the application accepts a user\u2011controlled value and performs client\u2011side navigation without checking the destination\u2019s origin, domain or protocol. Although it does not allow code execution or privilege escalation, it enables attackers to redirect legitimate users to malicious sites after login, facilitating phishing attacks and increasing the risk of credential theft.", "risk_and_exploitability": "The CVSS score of 5.7 rates this issue as moderate, and the EPSS score of less than 1% suggests a low likelihood of exploitation. However, once a user authenticates, a malicious attacker can direct them to arbitrary URLs which could cause phishing success. Because the attack vector requires only the ability to supply a URL to the continueAfterSignIn parameter, it can be leveraged by anyone with access to a login link or through social engineering. The CVE is not listed in the CISA KEV catalog at this time."}}}}, "created": "2026-01-29T09:09:09.634987+00:00", "updated": "2026-04-18T01:45:33.398235+00:00", "vendors": ["nocodb", "nocodb$PRODUCT$nocodb"]}