CVE-2026-31813 Details
Description
Supabase Auth is a JWT based API for managing users and issuing JWT tokens. Prior to 2.185.0, a vulnerability has been identified that allows an attacker to issue sessions for arbitrary users using specially crafted ID tokens when the Apple or Azure providers are enabled. The attacker issues a valid, asymmetrically signed ID token from their issuer for each victim email address, which then is sent to the Supabase Auth token endpoint using the ID token flow. If the ID token is OIDC compliant, the Auth server would validate it against the attacker-controlled issuer and link the existing OIDC identity (Apple or Azure) of the victim to an additional OIDC identity based on the ID token contents. The Auth server would then issue a valid user session (access and refresh tokens) at the AAL1 level to the attacker. This vulnerability is fixed in 2.185.0.
A vulnerability in Supabase Auth versions prior to 2.185.0 allows attackers to issue sessions for arbitrary users by exploiting the Apple or Azure authentication providers. This is achieved by sending specially crafted ID tokens from an attacker-controlled issuer to the Supabase Auth token endpoint. If the ID token is compliant with OpenID Connect (OIDC), the Auth server validates it and links the OIDC identity of the victim to the attacker's, resulting in the issuance of valid user session tokens. The vulnerability requires an Auth server with Apple or Azure providers enabled, an OIDC-compliant ID token issuer controlled by the attacker, and access to email addresses associated with user records on the Auth server.
Users are advised to update to Supabase Auth version 2.185.0 or later. For self-hosted deployments, it is recommended to establish a process for regular updates and to avoid exposing the Auth server directly to the internet. Instead, place it behind a reverse proxy that is kept up-to-date.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/supabase/auth/security/advisories/GHSA-v36f-qvww-8w8m | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| supabase auth | < 2.185.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 20, 2026 | Initial Analysis | [email protected] |
| Mar 11, 2026 | New CVE Received | [email protected] |