CVE-2026-63753 Details
Description
SurrealDB before 3.1.0 fails to refresh authentication state in LIVE SELECT subscriptions when session state changes. Attackers can continue receiving real-time notifications under revoked or expired session credentials until the connection closes.
An authentication bypass vulnerability has been identified in SurrealDB versions prior to 3.1.0. The issue arises in LIVE SELECT subscriptions, which do not refresh the authentication state when session credentials change. As a result, attackers can continue to receive real-time notifications under revoked or expired session credentials until the connection is closed. This vulnerability allows for continued access to resources previously permitted to the user, creating a confidentiality risk.
Users can update to SurrealDB version 3.1.0 or later, where this vulnerability has been patched. For those using unpatched versions, it is recommended to call 'reset()' to tear down all LIVE queries owned by the session, or 'kill' each outstanding 'live query ID' before changing session states. However, there is no client-side workaround for sessions that have expired.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/surrealdb/surrealdb/security/advisories/GHSA-4m82-p8cx-f94j | [email protected] | MitigationVendor Advisory |
| https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-live-query | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| surrealdb surrealdb | < 3.1.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 22, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | New CVE Received | [email protected] |