What is GHSA-32pg-rjqh-fhfp?

GHSA-32pg-rjqh-fhfp is a security advisory published by GitHub Security Advisories with High severity. SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc...

Which CVE IDs does GHSA-32pg-rjqh-fhfp cover?

GHSA-32pg-rjqh-fhfp covers the following CVE IDs: CVE-2026-63757. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-32pg-rjqh-fhfp?

GHSA-32pg-rjqh-fhfp has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-32pg-rjqh-fhfpHighCVSS 8.8

SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc...

Vendor

GitHub Security Advisories

Published

July 20, 2026

Last Modified

July 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-63757 →

📋 Description

SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.

🔗 References (4)

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-5qfp-32cf-69jh
https://nvd.nist.gov/vuln/detail/CVE-2026-63757
https://www.vulncheck.com/advisories/surrealdb-before-session-hijacking-via-rpc-sessions
https://github.com/advisories/GHSA-32pg-rjqh-fhfp