Supabase Realtime CVE-2026-54238

Exploitation requires a JWT validly signed with the tenant secret whose 'exp' (and the fix also addresses 'iat') claim is encoded as a JSON string instead of a JSON number; the string decodes to an Elixir binary that sorts greater than any integer time, so the expiry predicate wrongly passes. It affects ONLY the REST broadcast authorization path (RealtimeWeb.AuthTenant / secure_tenant_api on /api/broadcast); the realtime channel-join path (RealtimeChannel.confirm_token/1) is NOT affected because it has an additional is_integer(exp) guard. Limiting factors: signature verification and tenant-secret selection still apply, a configured role validator is not bypassed, only Supabase Realtime versions <= 2.102.2 are vulnerable, and the resulting impact of broadcasting messages is application specific. The exact means by which an attacker obtains a string-exp signed token is not described in the available sources.

All signals point to a genuinely low-priority issue rather than a high-CVSS/low-real-risk mismatch. The CVSS 3.1 base score is 3.1 (Low) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N: network-reachable but high attack complexity, requires some privilege, and yields only limited integrity impact (C:N, A:N). The vuln.today Decision label is 'monitor,' consistent with that low severity. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so there is no evidence of active or likely exploitation. Exploitation status: no public exploit identified at time of analysis (the only references are the GHSA advisory, PR #1934, the fix commit, and the v2.103.1 release - all remediation artifacts, not PoC/exploit code). One conflict must be flagged: the description calls this an 'unauthenticated attacker' issue, but the GHSA advisory explicitly states that signature verification and tenant-secret selection still apply and that a configured role validator is not bypassed - meaning the attacker needs a JWT validly signed with the tenant secret. Treat the 'unauthenticated' wording with caution; the PR:L metric and the advisory are the more reliable signal. The real-world impact is explicitly 'application specific,' further lowering generalized risk.

An actor holding a tenant JWT whose 'exp' claim is encoded as a JSON string (rather than a number) sends it to the REST broadcast endpoint after that timestamp has passed; the inconsistent expiry check accepts it, returns HTTP 202, and relays the actor's message to all channel subscribers. Because the integrity impact is application specific, the consequence depends on how subscribers act on broadcast content. No public exploit was identified in the input, and the high attack complexity (AC:H) reflects the unusual string-encoded 'exp' token condition required.