CVE-2026-63757

HIGH SEVERITY

CVSS Score & Metrics

Base Score

8.8 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H                                    

Vulnerability Description

SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.

Vulnerability Details

Published Date

July 20, 2026

Last Modified

July 20, 2026

CWE ID

CWE-306

Source

NVD

Vendor

surrealdb

Product

surrealdb

External References

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-5qfp-32cf-69jh
https://www.vulncheck.com/advisories/surrealdb-before-session-hijacking-via-rpc-sessions

CVE-2026-63757

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment