CVE-2026-63757 Details
Description
SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.
A session hijacking vulnerability exists in SurrealDB versions prior to 3.1.0. The issue arises because the HTTP '/rpc' sessions method discloses attached session UUIDs without authentication and allows the inclusion of arbitrary session fields without ownership verification. This vulnerability enables unauthenticated attackers to enumerate session UUIDs and impersonate authenticated users, granting access to read, write, and delete data, as well as escalate privileges.
Users can upgrade to SurrealDB version 3.1.0 or later, where this vulnerability has been patched. For those unable to upgrade, it is recommended to avoid using SDKs or client flows that attach sessions to HTTP '/rpc', particularly the Rust SDK's HTTP or HTTPS engines. Instead, use WebSocket transport or REST endpoints that do not populate the attached-session map. Additionally, restrict access to the '/rpc' endpoint to trusted clients at the network layer.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/surrealdb/surrealdb/security/advisories/GHSA-5qfp-32cf-69jh | [email protected] | Vendor Advisory |
| https://www.vulncheck.com/advisories/surrealdb-before-session-hijacking-via-rpc-sessions | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| surrealdb surrealdb | < 3.1.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |