CVE-2026-63753

MediumCVSS 4.3/10Last modified Jul 23, 2026

Description

SurrealDB before 3.1.0 fails to refresh authentication state in LIVE SELECT subscriptions when session state changes. Attackers can continue receiving real-time notifications under revoked or expired session credentials until the connection closes.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published
Jul 20, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-637546.5SurrealDB versions before 3.1.0 contain a denial of service vulnerability where malicious LIVE queries with WHERE clauses that evaluate to eCVE-2026-637556.5SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements (and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INCVE-2026-637568.1SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated reqCVE-2026-637578.8SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDsCVE-2026-637585.4SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database usersCVE-2026-637596.5SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. AuthenticateCVE-2026-63768.7A weakness in SpiceJet’s public booking retrieval page permits full passenger booking details to be accessed using only a PNR and last name,CVE-2026-637607.5SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, braCVE-2026-637614.3SurrealDB before 3.1.0 silently substitutes the ES384 algorithm when a JWT access method is configured with ALGORITHM ES512 (DEFINE ACCESS .CVE-2026-637626.5SurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains a denial of service vulnerability in its embedded JavaScript scripting engine, wCVE-2026-637638.8SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users (e.g., thosCVE-2026-637648.6LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery (SSRF) vulnerability in the _load_http_url function
CVE-2026-63753: Medium severity, CVSS 4.3 | Vulnix