medium4.3
CVE-2026-63753
SurrealDB before 3.1.0 fails to refresh authentication state in LIVE SELECT subscriptions when session state changes.
Impact
SurrealDB before 3.1.0 fails to refresh authentication state in LIVE SELECT subscriptions when session state changes. Attackers can continue receiving real-time notifications under revoked or expired session credentials until the connection closes.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Surrealdb | Surrealdb | before 3.1.0 |