Read the docs
TI-2026-79331 Aliases CVE-2026-54238

Expired JWTs accepted by Supabase Realtime REST broadcast endpoints

Priority LOW 15CWE-613Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-613.

Summary

Supabase Realtime before 2.103.1 accepts expired JWTs on its REST broadcast endpoints when the exp claim is a JSON string instead of a number. The flaw is insufficient session expiration (CWE-613). An unauthenticated attacker could broadcast realtime messages to subscribers, and the impact depends on the application.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects an expired integer exp token signed with the same tenant secret. The accepted request returns 202 and emits the broadcast to subscribers. This could allow an unauthenticated attacker can broadcast realtime messages to subscribers. The attack can be performed via the Internet/only from within the supabase project. The impact of broadcasting messages to subscribers is application specific. This issue has been patched in version 2.103.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00206 10th percentileScored 2026-11-07
Fix Fixed realtime (supabase): 2.103.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
supabaserealtimebefore 2.103.12.103.1Patch availableCNA
  • realtime Vendorsupabase Affected before 2.103.1 Fixed in 2.103.1 Patch available CNA

Remediation

Update Supabase Realtime to version 2.103.1, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA realtime (supabase) Fixed in 2.103.1

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-54238
  2. 2026-10-30 CISA SSVC decision points changed

References

Other 4

  • TI-2024-16040 Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the… CVSS 3.1CRITICAL 9.8
  • TI-2026-44468 Supabase Realtime: Incorrect Authorization CVSS 3.1MEDIUM 6.5
  • TI-2026-24366 Supabase Auth has insecure Apple and Azure authentication with ID tokens CVSS 3.1MEDIUM 4.8
  • TI-2025-30696 auth-js Vulnerable to Insecure Path Routing from Malformed User Input CVSS 4.0LOW 2.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences