Refine your search

2 vulnerabilities found for realtime by supabase

CVE-2026-54238 (GCVE-0-2026-54238)
Vulnerability from cvelistv5
Published
2026-10-22 17:22
Modified
2026-10-30 15:11
Severity ?
3.1 (Low) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE
  • CWE-613 - Insufficient Session Expiration
Summary
Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects an expired integer exp token signed with the same tenant secret. The accepted request returns 202 and emits the broadcast to subscribers. This could allow an unauthenticated attacker can broadcast realtime messages to subscribers. The attack can be performed via the Internet/only from within the supabase project. The impact of broadcasting messages to subscribers is application specific. This issue has been patched in version 2.103.1.
References
Impacted products
Vendor Product Version
supabase realtime Version: < 2.103.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54238",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T15:11:24.865400Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T15:11:34.608Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "realtime",
          "vendor": "supabase",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.103.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects an expired integer exp token signed with the same tenant secret. The accepted request returns 202 and emits the broadcast to subscribers. This could allow an unauthenticated attacker can broadcast realtime messages to subscribers. The attack can be performed via the Internet/only from within the supabase project. The impact of broadcasting messages to subscribers is application specific. This issue has been patched in version 2.103.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613: Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T17:22:50.862Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/supabase/realtime/security/advisories/GHSA-hg9h-6mhq-6c2v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/supabase/realtime/security/advisories/GHSA-hg9h-6mhq-6c2v"
        },
        {
          "name": "https://github.com/supabase/realtime/pull/1934",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supabase/realtime/pull/1934"
        },
        {
          "name": "https://github.com/supabase/realtime/commit/ac229d7eff2798b12b994e07bdd64f5e9b56374a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supabase/realtime/commit/ac229d7eff2798b12b994e07bdd64f5e9b56374a"
        },
        {
          "name": "https://github.com/supabase/realtime/releases/tag/v2.103.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supabase/realtime/releases/tag/v2.103.1"
        }
      ],
      "source": {
        "advisory": "GHSA-hg9h-6mhq-6c2v",
        "discovery": "UNKNOWN"
      },
      "title": "Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54238",
    "datePublished": "2026-10-22T17:22:50.862Z",
    "dateReserved": "2026-06-12T16:25:43.084Z",
    "dateUpdated": "2026-10-30T15:11:34.608Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-62247 (GCVE-0-2026-62247)
Vulnerability from cvelistv5
Published
2026-09-21 19:04
Modified
2026-09-22 15:40
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-863 - Incorrect Authorization
Summary
Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied presence.read. Under that differential policy, the client can receive presence_diff messages containing other members' presence metadata, including application-defined location, online-status, roster, viewing, or typing information. Deployments with uniform presence visibility have no differential, and postgres_changes row data is unaffected. This issue is fixed in version 2.111.2.
References
Impacted products
Vendor Product Version
supabase realtime Version: < 2.111.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-62247",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T14:12:26.229589Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:40:12.145Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "realtime",
          "vendor": "supabase",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.111.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied presence.read. Under that differential policy, the client can receive presence_diff messages containing other members\u0027 presence metadata, including application-defined location, online-status, roster, viewing, or typing information. Deployments with uniform presence visibility have no differential, and postgres_changes row data is unaffected. This issue is fixed in version 2.111.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T19:04:58.743Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/supabase/realtime/security/advisories/GHSA-rcr8-2525-4r7p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/supabase/realtime/security/advisories/GHSA-rcr8-2525-4r7p"
        },
        {
          "name": "https://github.com/supabase/realtime/pull/1969",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supabase/realtime/pull/1969"
        },
        {
          "name": "https://github.com/supabase/realtime/commit/c039bca9b57c2e554a67fdf462970b54641d82eb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supabase/realtime/commit/c039bca9b57c2e554a67fdf462970b54641d82eb"
        },
        {
          "name": "https://github.com/supabase/realtime/releases/tag/v2.111.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supabase/realtime/releases/tag/v2.111.2"
        }
      ],
      "source": {
        "advisory": "GHSA-rcr8-2525-4r7p",
        "discovery": "UNKNOWN"
      },
      "title": "Supabase Realtime: Incorrect Authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62247",
    "datePublished": "2026-09-21T19:04:58.743Z",
    "dateReserved": "2026-07-13T17:09:57.573Z",
    "dateUpdated": "2026-09-22T15:40:12.145Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}