CVE-2026-63757: SurrealDB before 3.1.0 Session Hijacking via /rpc sessions

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-20 · updated 2026-07-22
Weakness: CWE-306

Description

SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.

Affected products

surrealdb: before 3.1.0 — fixed in 3.1.0

How to fix

Upgrade to a fixed version: surrealdb 3.1.0. Check the vendor advisory for mitigations.

References

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-5qfp-32cf-69jh
https://www.vulncheck.com/advisories/surrealdb-before-session-hijacking-via-rpc-sessions

Get alerted when CVE-2026-63757 or the next vulnerability affects your stack