Skip to content
Threat Feed
Subscribe

Product

SurrealDB (Before 3.1.0)

1 brief RSS
high threat

CVE-2026-63757: SurrealDB Session Hijacking Vulnerability

SurrealDB versions prior to 3.1.0 are vulnerable to a session hijacking flaw (CVE-2026-63757) where unauthenticated attackers can enumerate session UUIDs via the HTTP /rpc sessions method and impersonate authenticated sessions to read, write, and delete data, leading to privilege escalation.

SurrealDB vulnerability session-hijacking privilege-escalation data-exfiltration denial-of-service webserver json-parsing
5t 1c