Skip to main content

SurrealDB CVE-2026-63757

| EUVDEUVD-2026-45928 HIGH
Missing Authentication for Critical Function (CWE-306)
2026-07-20 disclosure@vulncheck.com GHSA-32pg-rjqh-fhfp
Authentication Bypass
8.7
CVSS 4.0 · Vendor: vulncheck
Share

Severity by source

Vendor (vulncheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Network-reachable and low-complexity with no attacker auth (PR:N), but exploitation depends on a legitimate client having attached an authenticated session, mapped from CVSS 4.0 UI:P to UI:R; full C/I/A impact within the DB with no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

4
Patch available
Jul 20, 2026 - 15:33 EUVD
Source Code Evidence Fetched
Jul 20, 2026 - 12:38 vuln.today
Analysis Generated
Jul 20, 2026 - 12:38 vuln.today
CVE Published
Jul 20, 2026 - 12:19 cve.org
HIGH 8.7

DescriptionCVE.org

SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.

AnalysisAI

Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the HTTP /rpc 'sessions' method and then impersonate any authenticated session by supplying an arbitrary 'session' field that the /rpc handler never ownership-checks. Because impersonation inherits the victim session's authorization, an anonymous caller can read, write, and delete data and escalate to that session's level, up to root. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach HTTP /rpc endpoint over network
Delivery
Call unauthenticated sessions method
Exploit
Enumerate attached session UUIDs
Execution
Replay UUID in /rpc session field
Persist
Impersonate authenticated session
Impact
Read/write/delete data and escalate to root
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires (1) the SurrealDB HTTP /rpc endpoint to be network-reachable to the attacker, and (2) at least one client to have registered an authenticated session via {"method":"attach"} on that HTTP transport - in practice the official Rust SDK's Http/Https engine, which auto-attaches once per Surreal handle. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) with VC:H/VI:H/VA:H and a base score of 8.7 indicates a network-reachable, low-complexity, unauthenticated attack with high impact to confidentiality, integrity and availability but no scope change to other systems (SC/SI/SA:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An application uses the official Rust SDK's Http engine, which auto-attaches an authenticated (up to root) session to a SurrealDB < 3.1.0 instance reachable on the network. An unauthenticated attacker who can reach /rpc calls the 'sessions' method to list attached UUIDs, then issues an /rpc request carrying a victim's UUID in the 'session' field and is treated as that authenticated session, reading and deleting data and escalating privilege. …
Remediation Vendor-released patch: upgrade to SurrealDB 3.1.0 or later, in which HTTP sessions() now returns method_not_allowed, the /rpc handler gates client-supplied session IDs against the caller's request-level auth principal (actor id + level) and returns session_not_found on mismatch, and attached HTTP sessions are capped via the SURREAL_HTTP_MAX_ATTACHED_SESSIONS environment variable (patch commit https://github.com/surrealdb/surrealdb/commit/fd800fc7c55afcdc97057d18cf7cb7f83557e702). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, restrict network access to the HTTP /rpc endpoint to trusted internal networks only and evaluate disabling the 'sessions' method if business operations permit. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-306 – Missing Authentication for Critical Function

View all
CVE-2017-10271 HIGH POC
7.5
CVE-2025-3248 CRITICAL POC
9.8
CVE-2024-11680 CRITICAL POC
9.8
CVE-2025-0108 HIGH POC
8.8
CVE-2025-32433 CRITICAL POC
10.0
CVE-2016-2004 CRITICAL POC
9.8
CVE-2024-46506 CRITICAL POC
10.0
CVE-2025-8943 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2026-63757 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy