CVE-2026-63761

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.0

Description When a JWT access method is configured using the ALGORITHM ES512 parameter within the DEFINE ACCESS statement, the system silently substitutes the ES384 algorithm. This occurs because the underlying jsonwebtoken crate (v10.x) lacks an ES512 variant, causing the mapping to default to ES384 without generating errors, warnings, or log messages. Consequently, users providing a P-521 key for ES512 encounter authentication handshake failures due to a curve mismatch, as ES384 requires a P-384 curve. Additionally, tokens generated are rejected by external systems expecting genuine ES512 signatures. This issue does not allow for token forgery or compromise of data confidentiality and integrity.

Recommendations Update to version 3.1.0 or later.