CVE-2026-54238 Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects an expired integer exp token signed wit...

CVE-2026-54238

Prior to version 2.103.1 , Supabase Realtime REST broadcast endpoints incorrectly accepted expired JWTs when the exp claim was encoded as a JSON string instead of a JSON number. While the system correctly rejected expired tokens with integer claims, the string-based encoding flaw allowed an unaut...