CVE-2026-63753: SurrealDB before 3.1.0 Authentication Bypass via LIVE Query
Published Jul 20, 2026
·Updated
SurrealDB before 3.1.0 fails to refresh authentication state in LIVE SELECT subscriptions when session state changes. Attackers can continue receiving real-time notifications under revoked or expired session credentials until the connection closes.
Affected Software
2 affected components
SurrealDB SurrealDB<3.1.0
SurrealDB SurrealDB<3.1.0
Event History
Jul 20, 2026
CVE Published
via MITRE·12:04 PM
Data Sourced
via MITRE·12:04 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:19 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-63753?
CVE-2026-63753 has a medium severity rating of 5.3.
2
How can I fix CVE-2026-63753?
To fix CVE-2026-63753, upgrade to SurrealDB version 3.1.0 or later.
3
What does CVE-2026-63753 exploit?
CVE-2026-63753 exploits an authentication bypass in SurrealDB that affects LIVE Query subscriptions.
4
What are the potential consequences of CVE-2026-63753?
The consequences of CVE-2026-63753 include unauthorized access to real-time notifications under revoked or expired session credentials.
5
Which software is affected by CVE-2026-63753?
CVE-2026-63753 affects SurrealDB versions prior to 3.1.0.