Ericwhitefield

**Name of the Vulnerable Software and Affected Versions** SurrealDB versions prior to 1.5.4 **Description** Authentication validation is not properly handled when a scope user switches databases via the `USE` clause or the `use` method. An authenticated attacker can impersonate another user in a different database if a user record with the same identifier exists. This allows unauthorized actions in cases where permissions are based exclusively on the `$auth` parameter. **Recommendations** Update to version 1.5.4 or later.