PT-2026-61569 · Surrealdb · Surrealdb
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
SurrealDB versions prior to 3.1.0
Description
An issue exists where the system fails to refresh the authentication state in LIVE SELECT subscriptions when the session state changes. This allows an attacker to continue receiving real-time notifications even after session credentials have been revoked or have expired, provided the connection remains open.
Recommendations
Update to version 3.1.0 or later.
Fix
Insufficient Session Expiration
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Surrealdb