CVE-2026-54238: Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization
Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects an expired integer exp token signed with the same tenant secret. The accepted request returns 202 and emits the broadcast to subscribers. This could allow an unauthenticated attacker can broadcast realtime messages to subscribers. The attack can be performed via the Internet/only from within the supabase project. The impact of broadcasting messages to subscribers is application specific. This issue has been patched in version 2.103.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Supabase Realtimeto a version that resolves this vulnerability.Fixed in 2.103.1
Event History
Frequently Asked Questions
What must an attacker have or do to exploit this issue?
The attacker must submit a request to a REST broadcast endpoint using an expired JWT whose exp claim is encoded as a JSON string rather than a JSON number. The token must be signed with the tenant secret; an expired token with an integer exp is rejected on the same route.
Which deployments are affected?
Supabase Realtime versions before 2.103.1 are affected. The attack may be performed over the Internet or only from within the Supabase project, depending on the project’s exposure.
What is the observable impact of a successful exploit?
The REST endpoint returns HTTP 202 and emits the attacker-supplied broadcast to subscribers. The practical impact depends on how the application handles broadcast messages.
How can this be remediated?
Upgrade Supabase Realtime to version 2.103.1, which contains the patch.