CVE-2026-54238

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects an expired integer exp token signed with the same tenant secret. The accepted request returns 202 and emits the broadcast to subscribers. This could allow an unauthenticated attacker can broadcast realtime messages to subscribers. The attack can be performed via the Internet/only from within the supabase project. The impact of broadcasting messages to subscribers is application specific. This issue has been patched in version 2.103.1.

• CWE-613

• https://github.com/supabase/realtime/commit/ac229d7eff2798b12b994e07bdd64f5e9b56374a
• https://github.com/supabase/realtime/pull/1934
• https://github.com/supabase/realtime/releases/tag/v2.103.1
• https://github.com/supabase/realtime/security/advisories/GHSA-hg9h-6mhq-6c2v

Published

Oct 22, 2026

Last Modified

Oct 30, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54232vLLM is an inference and serving engine for large language m…8.8
• CVE-2026-54233vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-54234vLLM is a high-throughput and memory-efficient inference and…7.5
• CVE-2026-54235vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-54236vLLM is an inference and serving engine for large language m…5.3
• CVE-2026-54237Wavelog is web-based amateur radio logging software. From 1.…9.3
• CVE-2026-54239Faust.js is a headless WordPress toolkit. Prior to 1.8.11, t…8.8
• CVE-2026-54240libde265 is an open source implementation of the h.265 video…7.4
• CVE-2026-54241libde265 is an open source implementation of the h.265 video…7.4
• CVE-2026-54242Statamic is a Laravel and Git powered content management sys…4.9
• CVE-2026-54243Statamic is a Laravel and Git powered content management sys…6.1
• CVE-2026-54244Statamic is a Laravel and Git powered content management sys…3.5