SurrealDB before 1.5.4 Authentication Bypass via Database Switch
Priority LOW 24CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.
Summary
SurrealDB before 1.5.4 and 2.0.0-alpha.1 before 2.0.0-alpha.6 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00343 28th percentileScored 2026-11-07
Fix Fixed surrealdb (surrealdb): 1.5.4, 2.0.0-alpha.6surrealdb-core (surrealdb): 1.5.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| surrealdb | surrealdb | before 1.5.4 | 1.5.4 | Patch available | CNA |
| surrealdb | surrealdb | 2.0.0-alpha.1 to before 2.0.0-alpha.6 | 2.0.0-alpha.6 | Patch available | CNA |
| surrealdb | surrealdb-core | before 1.5.1 | 1.5.1 | Patch available | CNA |
- surrealdb Vendorsurrealdb Affected before 1.5.4 Fixed in 1.5.4 Patch available CNA
- surrealdb Vendorsurrealdb Affected 2.0.0-alpha.1 to before 2.0.0-alpha.6 Fixed in 2.0.0-alpha.6 Patch available CNA
- surrealdb-core Vendorsurrealdb Affected before 1.5.1 Fixed in 1.5.1 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:* | before 1.5.4 | Vulnerable | surrealdb |
| cpe:2.3:a:surrealdb:surrealdb:2.0.0:alpha1:*:*:*:*:*:* | 2.0.0 alpha1 | Vulnerable | surrealdb |
| cpe:2.3:a:surrealdb:surrealdb:2.0.0:alpha2:*:*:*:*:*:* | 2.0.0 alpha2 | Vulnerable | surrealdb |
| cpe:2.3:a:surrealdb:surrealdb:2.0.0:alpha3:*:*:*:*:*:* | 2.0.0 alpha3 | Vulnerable | surrealdb |
| cpe:2.3:a:surrealdb:surrealdb:2.0.0:alpha4:*:*:*:*:*:* | 2.0.0 alpha4 | Vulnerable | surrealdb |
| cpe:2.3:a:surrealdb:surrealdb:2.0.0:alpha5:*:*:*:*:*:* | 2.0.0 alpha5 | Vulnerable | surrealdb |
- cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:* Versions before 1.5.4 Vulnerable ·surrealdb
- cpe:2.3:a:surrealdb:surrealdb:2.0.0:alpha1:*:*:*:*:*:* Versions 2.0.0 alpha1 Vulnerable ·surrealdb
- cpe:2.3:a:surrealdb:surrealdb:2.0.0:alpha2:*:*:*:*:*:* Versions 2.0.0 alpha2 Vulnerable ·surrealdb
- cpe:2.3:a:surrealdb:surrealdb:2.0.0:alpha3:*:*:*:*:*:* Versions 2.0.0 alpha3 Vulnerable ·surrealdb
- cpe:2.3:a:surrealdb:surrealdb:2.0.0:alpha4:*:*:*:*:*:* Versions 2.0.0 alpha4 Vulnerable ·surrealdb
- cpe:2.3:a:surrealdb:surrealdb:2.0.0:alpha5:*:*:*:*:*:* Versions 2.0.0 alpha5 Vulnerable ·surrealdb
Remediation
- Fix · CNA surrealdb (surrealdb) Fixed in 1.5.4
- Fix · CNA surrealdb (surrealdb) Fixed in 2.0.0-alpha.6
- Fix · CNA surrealdb-core (surrealdb) Fixed in 1.5.1
Timeline
- 2026-10-02 Threatist record created from CVE-2024-58363
- 2026-10-29 Fix available: surrealdb/[email protected] · CNA
References
More Surrealdb vulnerabilities
- TI-2026-45344 SurrealDB before 3.1.0 Session Hijacking via /rpc sessions CVSS 4.0HIGH 8.7
- TI-2024-38452 SurrealDB before 1.1.0 Denial of Service via HTTP Headers CVSS 4.0HIGH 8.7
- TI-2026-45347 SurrealDB before 3.1.0 Denial of Service via JSON Parser CVSS 4.0HIGH 8.7
- TI-2026-45334 SurrealDB before 3.1.0 Denial of Service via malformed RPC use CVSS 4.0HIGH 8.7
- TI-2025-43508 SurrealDB before 2.2.2 SurrealQL Injection via export CVSS 4.0CRITICAL 9.4
- TI-2026-45343 SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition CVSS 4.0CRITICAL 9.2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences