Executive brief
SurrealDB is a database platform that supports JWT-based authentication with various cryptographic algorithms. When administrators configure ES512 (a strong cryptographic algorithm) for JWT access control, the system silently falls back to the weaker ES384 algorithm without any warning or error message. This causes legitimate authentication requests to fail when using the correct ES512 keys, and breaks compatibility with external systems expecting ES512 signatures. While the ES384 fallback itself remains secure, the silent downgrade and authentication failures disrupt operations for affected users.
Technical details
This vulnerability is a cryptographic algorithm downgrade caused by a missing ES512 variant in the jsonwebtoken Rust crate (v10.x). When a DEFINE ACCESS statement specifies ALGORITHM ES512, the internal algorithm conversion logic defaults to ES384 across all four conversion points without raising an error, warning, or log message. The root cause is the absence of ES512 support in the underlying dependency, leaving no explicit fallback handling. An authenticated user configuring ES512 access methods will experience authentication handshake failures due to elliptic curve mismatch (ES384 expects P-384; ES512 expects P-521). Tokens signed with the correct P-521 key are rejected, and external JWT verifiers expecting genuine ES512 signatures will reject SurrealDB-issued tokens. The vulnerability does not allow token forgery or compromise of confidentiality/integrity due to ES384's cryptographic strength. SurrealDB 3.1.0 and later patch this by blocking new ES512 DEFINE ACCESS statements with explicit error messages and adding runtime deprecation warnings for existing definitions.
Affected products
- SurrealDB SurrealDB < 3.1.0
Timeline
- 2026-05-27: disclosed: Advisory GHSA-fwg2-gr34-q3w8 published by SurrealDB
- 2026-07-20: advisory: Duplicate advisory GHSA-gw59-x2xr-wwvr published to GitHub Advisory Database; CVE-2026-63761 assigned
- 2026-05-27: patched: SurrealDB 3.1.0 released with patch
- 2026-09-04: other: Duplicate advisory GHSA-gw59-x2xr-wwvr withdrawn; references main advisory GHSA-fwg2-gr34-q3w8