CVE-2026-63757

highCVSS 8.8covered by 1 sourcefirst seen 2026-07-20

SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.

⚡ Watch CVE-2026-63757

Get an email if CVE-2026-63757 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all EPSS-scored CVEs.

Advisory coverage (1)

highCVE-2026-63757: SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc …nvd · 2026-07-20

External references

NVD record for CVE-2026-63757

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-63757 status](https://www.csirts.com/badge/CVE-2026-63757)](https://www.csirts.com/cve/CVE-2026-63757)