What is CVE-2026-63757?

CVE-2026-63757 is a high-severity vulnerability in Surrealdb, classified under Missing Authentication for Critical Function. CVSS score: 8.8/10. Published 2026-07-20.

How severe is CVE-2026-63757?

High severity. CVSS v3 base score is 8.8 out of 10.

Auth bypass in Surrealdb

CVE-2026-63757

SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.

Vulnerability class: Broken Authentication

EPSS: 0.005 (43.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Surrealdb — versions 0, 3.1.0

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

disclosure@vulncheck.com (vendor-advisory, Vendor Advisory)
disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2026-63757?: CVE-2026-63757 is a high-severity vulnerability in Surrealdb, classified under Missing Authentication for Critical Function. CVSS score: 8.8/10. Published 2026-07-20.
How severe is CVE-2026-63757?: High severity. CVSS v3 base score is 8.8 out of 10.