CVE-2026-121419

SurrealDB versions 3.1.0 through 3.3.0 are vulnerable to an improper authentication vulnerability. The flaw exists because the MCP BoundSubject fingerprint utilizes the access method name rather than a unique per-user identity for JWT/Bearer access. This oversight allows an attacker possessing a ...