SurrealDB session hijacking via HTTP RPC session leak

Executive brief

SurrealDB is a multi-model database used for managing and storing application data. A security flaw in its HTTP interface allows unauthorized individuals to discover active user session IDs and use them to take over those accounts. An attacker could use this access to read, modify, or delete sensitive database information, potentially gaining full administrative control over the database.

Technical details

A session fixation and information disclosure vulnerability exists in SurrealDB's HTTP /rpc implementation. The `sessions` method incorrectly returned all 'attached' session UUIDs to unauthenticated callers, while the /rpc handler failed to verify ownership of session IDs provided in the `session` field. An attacker can enumerate these UUIDs and impersonate any authenticated session that was registered via the `attach` method (commonly used by the official Rust SDK). This allows for full session hijacking, enabling the attacker to perform any action authorized for the victim session, including data manipulation and privilege escalation. The issue is fixed in version 3.1.0 by disabling the HTTP `sessions()` method and implementing strict ownership checks for session IDs.

Affected products

• SurrealDB SurrealDB < 3.1.0

Timeline

• 2026-05-27: disclosed: Initial disclosure date listed in researcher profile
• 2026-07-01: advisory: GitHub Advisory published
• 3.1.0: patched

References

• https://api.github.com/users/addcontent
• https://github.com/addcontent
• https://api.github.com/users/addcontent/gists%7B/gist_id%7D
• https://api.github.com/users/addcontent/repos
• https://avatars.githubusercontent.com/u/59762500?v=4
• https://api.github.com/users/addcontent/events%7B/privacy%7D