NocoDB SSO Is a Licensed Feature — and the Env Vars Won't Tell You

Description and use

Enabling OIDC SSO on an unlicensed NocoDB instance crashes the server, creating a denial‑of‑service risk and misleading users about licensing.

Problem

Enabling OIDC SSO on an unlicensed self‑hosted NocoDB instance crashes the server, creating a denial‑of‑service risk and misleading users about licensing.

Outcome

An unauthenticated request to the OIDC callback route on an unlicensed NocoDB instance terminates the server, exposing a denial‑of‑service vector and revealing that OIDC SSO is a paid feature.

Workflow

• 1. Pull the NocoDB image. 2. Start a throwaway container with SQLite metadata store and set the six OIDC environment variables. 3. Observe the startup log: "No license key found — running in CE mode". 4. Send an unauthenticated GET to /auth/oidc. 5. The container exits with exit code 1 and the OIDC route is no longer available.
• 6. Verify the container is stopped with docker ps -a.

Evidence

NocoDB's OIDC SSO is a paid feature.

Source

The route that handles the OIDC callback is reachable without authentication — it has to be, that's how a login flow starts.

Source

No license key found — running in CE mode

Source

UNCAUGHT EXCEPTION ### unhandledRejection TypeError: _0x418c23 is not a function at docker/index.js:1:27483406

Source