CVE-2026-63757CWE-306

SurrealDB before 3.1.0 Session Hijacking via /rpc sessions

High · published July 20, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
44.4
In the wild
Unconfirmed
What it is

SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00536 · 44.4th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-07-20T12:04Z
EPSS history
Timeline
  • 20 JUL 12:04Z
    SurrealDB before 3.1.0 Session Hijacking via /rpc sessions
    cvelistv5