Supabase

5 CVEs in 4 Supabase products, including Realtime, Auth, Auth-Js. Newest: CVE-2026-54238 (2026-10-22). Severity, EPSS and public exploits for each.

Supabase products with known CVEs

ProductCVEs
Realtime2
Auth1
Auth-Js1
Postgres1
Supabase CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-54238Low3.12026-10-22Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired J…
CVE-2026-62247Medium6.52026-09-21Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-…
CVE-2026-31813Medium4.82026-03-11Supabase Auth is a JWT based API for managing users and issuing JWT tokens. Prior to 2.185.0, a vulnerability has been identified that allows an attacker to is…
CVE-2025-483702025-05-27auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.70.0, the library functions getUserById, deleteUser, updateUserById, listFact…
CVE-2024-24213Critical9.82024-02-08Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query. NOTE: the vendor's position is that…