CVE-2026-54238

Name of the Vulnerable Software and Affected Versions Supabase Realtime versions prior to 2.103.1

Description REST broadcast endpoints accept an expired JSON Web Token (JWT) if the exp claim is encoded as a JSON string rather than a JSON number. While the system correctly rejects expired tokens using integer values for the exp claim, this inconsistency allows unauthenticated attackers to broadcast realtime messages to subscribers. The attack can be executed over the internet or from within the Supabase project, with the impact depending on the specific application implementation.

Recommendations Update to version 2.103.1.