NocoDB versions prior to 0.301.3 have a vulnerability where the password reset process does not revoke existing refresh tokens. This allows an attacker who has previously stolen a refresh token to continue generating valid JWTs even after the victim resets their password. The issue was fixed in version 0.301.3.