CVE-2026-63761

SurrealDB before 3.1.0 silently substitutes the ES384 algorithm when a JWT access method is configured with ALGORITHM ES512 (DEFINE ACCESS ... TYPE JWT ALGORITHM ES512), because the underlying jsonwebtoken crate (v10.x) has no ES512 variant and the mapping defaults to ES384 without any error, warning, or log message. Users who supply the correct P-521 key for ES512 experience authentication handshake failures due to the curve mismatch with ES384 (which expects P-384), and tokens are rejected by external systems expecting genuine ES512 signatures. The flaw cannot be used to forge tokens or compromise data confidentiality or integrity, as ES384 remains cryptographically strong.

• CWE-327

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-fwg2-gr34-q3w8Vendor Advisory, Mitigation
• https://www.vulncheck.com/advisories/surrealdb-before-algorithm-downgrade-via-es512Third Party Advisory

Published

Jul 20, 2026

Last Modified

Jul 22, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63756SurrealDB versions before 3.1.0 contain a time-of-check/time…9.2
• CVE-2026-63757SurrealDB versions before 3.1.0 contain a session hijacking …8.8
• CVE-2026-63758SurrealDB versions before 3.1.0 contain an authorization byp…5.4
• CVE-2026-63759SurrealDB before 3.1.0 fails to enforce recursion depth limi…7.1
• CVE-2026-6376A weakness in SpiceJet’s public booking retrieval page permi…8.7
• CVE-2026-63760SurrealDB before 3.1.0 fails to enforce the configured recur…8.7
• CVE-2026-63762SurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains …6.5
• CVE-2026-63763SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a co…8.8
• CVE-2026-63764LMDeploy through 0.14.0, fixed in commit 03c3130, contains a…8.6
• CVE-2026-63765Chatwoot before 4.16.0 contains an authentication bypass vul…8.8
• CVE-2026-63766GPT-SoVITS through 20250606v2pro contains an OS command inje…9.8
• CVE-2026-63767ktransformers through 0.6.3, fixed in commit def0f93, contai…9.8