Algorithm Downgrade Issue in SurrealDB by SurrealDB Team

CVE-2026-63761

What is CVE-2026-63761?

SurrealDB versions prior to 3.1.0 experience an algorithm downgrade issue where the ES512 algorithm for JWT access is silently replaced with ES384 due to limitations in the associated jsonwebtoken crate. Users configuring access with the ES512 algorithm face failures during authentication, as the actual curve used for ES384 (P-384) differs from the one expected for ES512 (P-521). This leads to rejected tokens from external systems that anticipate valid ES512 signatures, creating potential issues in user authentication workflows while not compromising data confidentiality or integrity.

References