CVE-2026-63757 | SurrealDB versions before 3.1.0 contain a session hijacking … | CVSS 8.8 HIGH

Description

SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.

Metadata

CVE ID: CVE-2026-63757
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-18 12:30 UTC
Published: 2026-07-20 12:04 UTC
Last updated: 2026-07-20 15:52 UTC
Primary CWE: CWE-306
Missing Authentication for Critical Function
Vendor / Product: surrealdb / surrealdb
Sources: cve.org · NVD

Severity & Metrics

8.8 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
surrealdb	surrealdb	—	0 < 3.1.0, 3.1.0

Weakness (CWE)

CWE	Source	Description
CWE-306	cna	Missing Authentication for Critical Function

CVSS scores (2)

Score	Severity	Version	Source	Vector
8.8	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.7	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (2)

GitHub Security Advisory (GHSA-5qfp-32cf-69jh) https://github.com/surrealdb/surrealdb/security/advisories/GHSA-5qfp-32cf-69jh
VulnCheck Advisory: SurrealDB before 3.1.0 Session Hijacking via /rpc sessions https://www.vulncheck.com/advisories/surrealdb-before-session-hijacking-via-rpc-sessions