supahunter

Supabase Hunter OP Mode Advanced Reconnaissance & Exploitation Tool for Supabase Instances. SupaHunter is a powerful Python tool designed to identify, analyze, and exploit misconfigured Supabase projects. It goes beyond simple table enumeration, offering deep inspection capabilities, Selenium-bas...

EUVD-2026-84066

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

PT-2026-85579

Name of the Vulnerable Software and Affected Versions Chatbot UI affected versions not specified Description An authorization bypass exists in the retrieval endpoint. Authenticated attackers can access private file content of other users by providing arbitrary file UUIDs. The issue occurs because...

Supabase Realtime Channel Abuse

Joins Supabase Realtime Phoenix channels for PostgREST tables using a leaked anon or servicerole key — tests RLS bypass on live subscriptions. !/usr/bin/env python3 -- coding: utf-8 -- """ Abuse Supabase Realtime channels using leaked anon/servicerole JWT keys. Follow-up for...