CVE-2026-63753 in SurrealDB
Summary
by MITRE • 07/20/2026
SurrealDB before 3.1.0 fails to refresh authentication state in LIVE SELECT subscriptions when session state changes. Attackers can continue receiving real-time notifications under revoked or expired session credentials until the connection closes.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability affects SurrealDB versions prior to 3.1.0 and represents a critical session management flaw that undermines the database's security model. The issue stems from improper handling of authentication state within LIVE SELECT subscriptions, which are real-time notification mechanisms that allow clients to receive updates when data changes. When a user's session credentials expire or are revoked through administrative actions, the system fails to invalidate the associated LIVE SELECT subscriptions, creating a persistent security gap where unauthorized access can continue despite legitimate credential revocation.
The technical implementation flaw occurs at the subscription state management layer where the database does not properly monitor or validate session authenticity during the lifetime of LIVE SELECT operations. This behavior violates fundamental security principles outlined in cwe-284 access control mechanisms and cwe-306 missing authentication checks. The vulnerability specifically impacts the database's ability to maintain consistent authentication state across real-time communication channels, creating a scenario where revoked sessions can continue operating with elevated privileges until the underlying connection terminates naturally.
From an operational perspective this vulnerability enables persistent unauthorized access patterns that can remain undetected for extended periods. Attackers who have previously obtained valid session credentials can continue receiving real-time notifications about data changes even after their access rights have been removed or expired. This creates a significant risk for environments where sensitive data is monitored through LIVE SELECT subscriptions, as it allows attackers to maintain ongoing surveillance capabilities without proper authentication validation. The attack pattern aligns with techniques described in the attack tactic TA0006 credential access and can be classified under the attack technique T1586 account manipulation.
The impact extends beyond simple unauthorized access to include potential data exfiltration and monitoring capabilities that could compromise entire database ecosystems. Organizations relying on real-time notification systems for critical operations face heightened risk as attackers can maintain continuous visibility into data changes without proper authentication checks. This vulnerability particularly affects systems where LIVE SELECT subscriptions are used for audit logging, security monitoring, or real-time alerting mechanisms, as it undermines the integrity of these protective measures.
Mitigation strategies should focus on immediate database upgrades to version 3.1.0 or later where this issue has been resolved through enhanced session state management. Organizations should implement immediate connection termination for revoked sessions and establish monitoring procedures to detect abnormal subscription behavior. The fix addresses the root cause by ensuring proper authentication state validation during LIVE SELECT subscription lifecycle management, preventing unauthorized continuation of real-time notifications under invalid credentials. Additionally, security teams should conduct comprehensive audits of existing LIVE SELECT subscriptions to identify and terminate any potentially compromised connections while implementing enhanced session monitoring protocols that align with industry best practices for real-time communication security.