Unauthorized Message Broadcasting in Supabase Realtime by Supabase
CVE-2026-54238

3.1LOW

Key Information:

Vendor

Supabase

Status
Realtime
Vendor
CVE Published:
22 October 2026

What is CVE-2026-54238?

Supabase Realtime, which provides real-time messaging capabilities via WebSockets, contains a vulnerability that allows unauthenticated attackers to broadcast messages to subscribers by exploiting the handling of expired JSON Web Tokens (JWTs). Specifically, prior to version 2.103.1, the system incorrectly accepted expired JWTs when their 'exp' claim was encoded as a JSON string, while correctly rejecting integer-formatted expired tokens. This oversight could lead to unauthorized users sending real-time messages, thus affecting the integrity of communications within applications using the service. The vulnerability has been addressed and patched in the latest version.

Affected Version(s)

realtime < 2.103.1

References

https://github.com/supabase/realtime/security/advisories/...
x_refsource_CONFIRM
https://github.com/supabase/realtime/pull/1934
x_refsource_MISC
https://github.com/supabase/realtime/commit/ac229d7eff279...
x_refsource_MISC

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.