CVE-2026-63761 Details
Description
SurrealDB before 3.1.0 silently substitutes the ES384 algorithm when a JWT access method is configured with ALGORITHM ES512 (DEFINE ACCESS ... TYPE JWT ALGORITHM ES512), because the underlying jsonwebtoken crate (v10.x) has no ES512 variant and the mapping defaults to ES384 without any error, warning, or log message. Users who supply the correct P-521 key for ES512 experience authentication handshake failures due to the curve mismatch with ES384 (which expects P-384), and tokens are rejected by external systems expecting genuine ES512 signatures. The flaw cannot be used to forge tokens or compromise data confidentiality or integrity, as ES384 remains cryptographically strong.
A vulnerability exists in SurrealDB versions prior to 3.1.0, where the ES512 algorithm for JWT access methods is silently downgraded to ES384. This occurs because the jsonwebtoken crate version 10.x does not support ES512, leading to a default substitution without any error or warning. As a result, users who provide the correct P-521 key for ES512 face authentication failures due to a curve mismatch, while external systems rejecting tokens with ES384 signatures exacerbate the issue. Although this flaw disrupts authentication, it does not allow token forgery or compromise data confidentiality or integrity, as ES384 remains a strong cryptographic algorithm.
Users can update to SurrealDB version 3.1.0 or later, where this vulnerability is patched. For those using versions prior to 3.1.0, it is recommended to reconfigure JWT access methods to use a supported algorithm like ES384 with a P-384 key pair. Review and update any 'DEFINE ACCESS' statements that specify 'ALGORITHM ES512'.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/surrealdb/surrealdb/security/advisories/GHSA-fwg2-gr34-q3w8 | [email protected] | Vendor AdvisoryMitigation |
| https://www.vulncheck.com/advisories/surrealdb-before-algorithm-downgrade-via-es512 | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| surrealdb surrealdb | < 3.1.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |