NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter
Date: 2026-01
Affected: npm/nocodb
Attack vector: rce
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-24768
CWE: CWE-601

### Summary An **unvalidated redirect (open redirect)** vulnerability exists in NocoDB’s login flow due to missing validation of the `continueAfterSignIn` parameter. During authentication, NocoDB processes a user-controlled redirect value and conditionally performs client-side navigation without enforcing any restrictions on the destination’s origin, domain or protocol. This allows attackers to redirect authenticated users to arbitrary external websites after login. ### Root Cause The redirect logic relies on a permissive URL check that treats any absolute or protocol-relative URL as safe, and performs navigation without applying an allowlist or origin validation. In the redirect plugin: * The helper function `isFullUrl` uses the following regular expression: ```ts /^(https?:)?\/\// ``` This pattern matches any HTTP(S) URL as well as protocol-relative URLs (e.g., `//evil.example`), without restricting allowed domains. * When the `continueAfterSignIn` query parameter matches this pattern, the application performs an unconditional external navigation: ```ts navigateTo(route.value.query.continueAfterSignIn as string, { external: isFullUrl(...) }) ``` ### Attack Scenario An attacker can exploit this issue through a phishing attack: 1. The attacker crafts a malicious login URL containing a controlled redirect target, for example: ``` https://victim-nocodb.example/#/signin?continueAfterSignIn=https://evil-phishing.com/fake-login ``` 2. The


Mitigations:

Architectural layers (MAESTRO):