Vulnerabilities

TI-2026-79331 CVE-2026-54238

Expired JWTs accepted by Supabase Realtime REST broadcast endpoints

LOW 15

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00206 Published 2026-10-22 Fixed in 2.103.1 CWE-613

TI-2026-44468 CVE-2026-62247

LOW 29

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00451 Published 2026-09-21 Fixed in 2.111.2 CWE-863

TI-2026-24366 CVE-2026-31813

LOW 21

Supabase Auth is a JWT based API for managing users and issuing JWT tokens.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.0016 Published 2026-03-11 Fixed in 2.185.0 CWE-290

TI-2025-30696 CVE-2025-48370 · GHSA-8r88-6cj9-9fh5

LOW 21

auth-js is an isomorphic Javascript library for Supabase Auth.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.00902 Published 2025-05-27 Fixed in 2.70.0 CWE-22

TI-2024-16040 CVE-2024-24213 · GHSA-vq84-wx4w-6r76

MEDIUM 51

Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01069 Published 2024-02-08 No fix listed CWE-89