Missing Authentication Vulnerability in SurrealDB Affects User Token Management
CVE-2026-109342

5.3MEDIUM

Key Information:

Vendor

Surrealdb

Status
Surrealdb
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109342?

SurrealDB versions prior to 3.3.0 have a missing authentication flaw within the revoke RPC method. This vulnerability permits low-privileged or unauthenticated users to invalidate the refresh tokens of other users without necessary proof of possession. Attackers can exploit this by obtaining grant identifiers through the ACCESS SHOW ALL command with VIEWER permissions or by leveraging leaked tokens. The ability to permanently revoke refresh tokens could force other users into re-authentication, posing serious security risks.

Affected Version(s)

surrealdb 3.0.0 < 3.3.0

surrealdb 3.3.0

References

https://github.com/surrealdb/surrealdb/security/advisorie...
vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-3.0.0-befo...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yanhaoxi
.