CVE-2026-63757 SurrealDB before 3.1.0 Session Hijacking via /rpc sessions
Unauthenticated attackers can hijack sessions in SurrealDB to read, modify, or delete data and escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-63757?
CVE-2026-63757 is a high-severity authentication bypass vulnerability in Surrealdb Surrealdb, published on 20 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.
Weakness: CWE-306
Which versions are affected by CVE-2026-63757?
It affects 1 product.
Products include Surrealdb Surrealdb.
How do I fix CVE-2026-63757?
No fix has been published for CVE-2026-63757 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-63757 being exploited?
There is no known exploitation of CVE-2026-63757 in the wild and no public exploit code.
Other vulnerabilities in Surrealdb Surrealdb
- CVE-2025-71392 SurrealDB before 2.2.2 SurrealQL Injection via export
- CVE-2026-63756 SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition
- CVE-2026-63747 SurrealDB before 3.1.0 Denial of Service via malformed RPC use
- CVE-2026-63760 SurrealDB before 3.1.0 Denial of Service via JSON Parser
- CVE-2023-54366 SurrealDB before 1.0.1 Insecure Default Table Permissions
Sources
Also known as GHSA-32pg-rjqh-fhfp.