CVE-2026-54238

LowCVSS 3.1

Published: 22/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

Supabase Realtime prior to version 2.103.1 accepts an expired JWT on REST broadcast endpoints when the exp claim is encoded as a JSON string instead of a number. This allows an unauthenticated attacker to broadcast realtime messages to subscribers.

Risk Assessment

An attacker could send spoofed messages to subscribers, potentially disrupting the application or misleading users. Impact depends on the application logic using Realtime.

Recommendation

Upgrade Supabase Realtime to version 2.103.1 or later. Until then, restrict access to broadcast endpoints and monitor for anomalous broadcasts.

Other vulnerabilities in Supabase Realtime

CVE-2026-62247Medium
Supabase Realtime before version 2.111.2 has a vulnerability in authorization that does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied presence.read. Under that differential policy, the client can receive presence_diff messages containing other members' presence metadata, including application-defined location, online-status, roster, viewing, or typing information. Deployments with uniform presence visibility have no differential, and postgres_changes row data is unaffected. This issue is fixed in version 2.111.2.

Original NVD description (English source)

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects an expired integer exp token signed with the same tenant secret. The accepted request returns 202 and emits the broadcast to subscribers. This could allow an unauthenticated attacker can broadcast realtime messages to subscribers. The attack can be performed via the Internet/only from within the supabase project. The impact of broadcasting messages to subscribers is application specific. This issue has been patched in version 2.103.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS