CVE-2026-63757 in SurrealDB
Summary
by MITRE • 07/20/2026
SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability in SurrealDB versions prior to 3.1.0 represents a critical session management flaw that directly undermines the database's authentication and authorization mechanisms. The issue stems from the /rpc sessions method which was designed to provide session information but failed to implement proper access controls, allowing any unauthenticated attacker to retrieve active session identifiers simply by making a request to this endpoint. The vulnerability manifests through two primary technical weaknesses: first, the method returns attached session UUIDs without requiring any authentication credentials, and second, it accepts arbitrary session fields without verifying ownership or authorization status. This combination creates a dangerous scenario where attackers can enumerate legitimate session identifiers and subsequently impersonate authenticated users within the system.
The operational impact of this vulnerability extends far beyond simple information disclosure, as it enables full privilege escalation and data manipulation capabilities. An attacker who discovers valid session UUIDs can use them to perform read operations on database content, write new records, modify existing data, delete information, and ultimately escalate their privileges to administrative levels within the SurrealDB environment. This vulnerability directly maps to CWE-306, which addresses missing authentication for critical functions, and represents a classic session hijacking attack vector that allows unauthorized users to assume legitimate user identities. The flaw essentially provides attackers with a backdoor into authenticated sessions without needing valid credentials or access to user accounts.
From an ATT&CK framework perspective, this vulnerability enables multiple techniques including T1566 for credential harvesting through session enumeration and T1078 for valid account access using compromised session identifiers. The lack of ownership verification in the session handling mechanism creates a path for privilege escalation attacks where attackers can leverage legitimate session tokens to perform operations outside their intended scope. The vulnerability affects the integrity, confidentiality, and availability of the database system by allowing unauthorized data access and modification. Organizations running affected versions of SurrealDB face significant risk of data breaches, unauthorized modifications, and potential complete system compromise.
The recommended mitigations include immediate upgrade to SurrealDB version 3.1.0 or later where this vulnerability has been addressed through proper authentication requirements for session enumeration and ownership verification for session fields. Administrators should also implement network-level controls to restrict access to the /rpc endpoints and consider additional authentication layers such as API key management or rate limiting to prevent automated session enumeration attacks. The fix implemented in version 3.1.0 likely involves adding mandatory authentication checks before session UUIDs are returned and implementing proper validation of session fields to ensure they belong to authenticated users. Organizations should also conduct thorough security assessments of their SurrealDB deployments to identify any potential exploitation attempts that may have occurred due to this vulnerability.