Session hijacking via unauthenticated /rpc session enumeration in SurrealDB (CVE-2026-63757)

The HTTP `/rpc` `sessions` method in SurrealDB returned all attached session UUIDs without requiring authentication, and the `/rpc` handler accepted arbitrary session identifiers with no ownership verification. An unauthenticated network attacker could enumerate session UUIDs and impersonate any authenticated attached session, gaining the ability to read, write, and delete data accessible to that session, dump metadata, invalidate sessions, and escalate to that session's privilege level up to root. Affected versions: - <3.1.0 We recommend updating to: 3.1.0. CVSS 8.7 · our assessment: this_week Reference: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-5qfp-32cf-69jh Details: https://vuln.today/cve/CVE-2026-63757