CVE-2026-63757 — SurrealDB before 3.1.0 Session Hijacking via /rpc sessions
SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts a…
Published: 2026-07-20 · CVSS: 8.7 · CVSS 4.0
SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7