TOCTOU race condition in SurrealDB HTTP RPC endpoint (CVE-2026-63756)

SurrealDB's HTTP /rpc endpoint contains a time-of-check/time-of-use (TOCTOU) race condition in which concurrent requests share mutable authentication state. An unauthenticated request racing against an active authenticated request can inherit the authenticated session's context and execute operations with the hijacked user's privileges. No credentials or session knowledge are required; only the ability to send concurrent HTTP requests to the /rpc endpoint while legitimate authenticated traffic is active. Affected versions: - <3.1.0 We recommend updating to: 3.1.0. CVSS 9.2 · our assessment: act_now Reference: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-4vgr-h27g-cf9p Details: https://vuln.today/cve/CVE-2026-63756