Threats tagged 'ghsa-mc8q-8prc-j4hf'

NocoDB versions 0.300.0 up to but not including 2026.08.0 have a missing authentication vulnerability in the POST /api/v2/oauth/authorize endpoint. This flaw allows unauthenticated attackers to create OAuth authorization codes by sending requests with specific parameters, resulting in unbounded insertion of ownerless authorization code records. The vulnerability is limited by rate limiting but can lead to unauthorized creation of authorization codes.