CVE-2026-63753: SurrealDB Auth Bypass Vulnerability

CVE-2026-63753 Overview

CVE-2026-63753 affects SurrealDB versions prior to 3.1.0. The database fails to refresh authentication state in LIVE SELECT subscriptions when the underlying session state changes. Attackers retain the ability to receive real-time notifications using revoked or expired session credentials until the WebSocket connection closes. The flaw is categorized under [CWE-613] Insufficient Session Expiration and represents an authentication bypass via long-lived subscriptions. Exploitation requires only low-privileged network access and no user interaction. The vendor addressed the issue in SurrealDB 3.1.0.

Critical Impact
Attackers with revoked or expired credentials can continue receiving real-time data notifications through active LIVE SELECT subscriptions, bypassing session invalidation controls.

Affected Products

SurrealDB versions prior to 3.1.0
Deployments exposing LIVE SELECT (live query) subscriptions over WebSocket
Multi-tenant SurrealDB instances relying on session revocation for access control

Discovery Timeline

2026-07-20 - CVE-2026-63753 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-63753

Vulnerability Analysis

SurrealDB supports LIVE SELECT queries, a real-time subscription mechanism that streams record changes to connected clients over persistent WebSocket connections. When a client issues a LIVE SELECT, the server binds the subscription to the authentication context present at subscription time. The server does not re-evaluate that context when session state later changes. Token revocation, session invalidation, and credential expiration events do not propagate to active live query streams. The subscription continues emitting notifications until the underlying transport connection terminates.

This behavior contradicts the security model expected of session revocation. Administrators who invalidate a compromised token, disable a user, or shorten a session lifetime assume that data access ceases immediately. In vulnerable versions, notifications keep flowing to the attacker for the duration of the connection.

Root Cause

The root cause is insufficient session expiration [CWE-613] within the live query subsystem. Authentication is validated at subscription establishment but is never re-checked during the streaming phase. There is no periodic revalidation loop, no server-side propagation of revocation events into active live query handlers, and no forced disconnect on credential expiry.

Attack Vector

An attacker first obtains valid credentials, whether legitimately issued or through prior compromise, and opens a LIVE SELECT subscription against a target table or record set. When the credentials are later revoked or expire, the attacker maintains the open WebSocket and continues receiving mutation events. Because delivery occurs over an already-authenticated channel, standard access logs may not flag the ongoing data exposure. The attack requires network reachability to the SurrealDB endpoint and low-level authenticated privileges sufficient to establish a live query.

See the GitHub Security Advisory GHSA-4m82-p8cx-f94j and the VulnCheck Security Advisory for vendor technical details.

Detection Methods for CVE-2026-63753

Indicators of Compromise

Long-lived WebSocket connections to SurrealDB endpoints that persist after user credential revocation or session termination events
LIVE SELECT subscriptions associated with session identifiers no longer present in the active session store
Data change notifications delivered to clients whose authentication tokens appear in revocation lists

Detection Strategies

Correlate SurrealDB access logs with identity provider revocation events to identify streams that outlived their credentials
Enumerate active live query subscriptions on the server and cross-reference against the current valid session table
Alert on WebSocket sessions to SurrealDB with connection durations exceeding configured session lifetime

Monitoring Recommendations

Enable verbose logging of LIVE SELECT subscription creation, including session ID, user, and timestamp
Forward SurrealDB and reverse proxy connection logs to a centralized SIEM for correlation with authentication events
Track WebSocket connection counts and durations per user to baseline normal behavior and detect anomalous long-running sessions

How to Mitigate CVE-2026-63753

Immediate Actions Required

Upgrade SurrealDB to version 3.1.0 or later, which enforces authentication state refresh in live query handlers
Forcibly terminate all active WebSocket connections after any credential revocation or session invalidation event
Inventory production SurrealDB deployments and identify instances exposing live query functionality to untrusted networks

Patch Information

SurrealDB 3.1.0 remediates CVE-2026-63753 by refreshing authentication state in LIVE SELECT subscriptions when session state changes. Review the GitHub Security Advisory GHSA-4m82-p8cx-f94j for release notes and upgrade guidance.

Workarounds

Restrict SurrealDB WebSocket endpoints to trusted networks using firewall rules or a reverse proxy access control list until patching is complete
Configure short session and token lifetimes combined with forced client reconnection to limit the window during which stale subscriptions can persist
Terminate WebSocket connections at the reverse proxy layer on a scheduled interval to force clients to re-authenticate and re-subscribe

bash

# Configuration example: force periodic WebSocket termination at the reverse proxy (nginx)
# Limits maximum lifetime of any single live query stream to 5 minutes.
location /rpc {
    proxy_pass http://surrealdb_upstream;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_read_timeout 300s;
    proxy_send_timeout 300s;
}