supahunter

Supabase Hunter OP Mode Advanced Reconnaissance & Exploitation Tool for Supabase Instances. SupaHunter is a powerful Python tool designed to identify, analyze, and exploit misconfigured Supabase projects. It goes beyond simple table enumeration, offering deep inspection capabilities, Selenium-bas...

CVE-2025-51862

CVE-2025-51862 Vulnerability description TelegAI, a web application for constructing and chatting with AI Characters, is vulnerable to Insecure Direct Object Reference IDOR in its chat component. An attacker can exploit this IDOR to tamper other users' conversation. Additionally, malicious conten...

nextjs-supabase-stripe-security-checker

nextjs-supabase-stripe-security-checker Free, local security scan for Next.js + Supabase + Stripe apps: leaked keys, missing RLS and grants, unsafe Stripe webhooks. Your AI agent shipped the app. Did it also ship your Stripe secret key, a table without RLS, or a webhook that anyone can call? One...

auth

Auth - Authentication and User Management by Supabase Auth is a user management and authentication server written in Go that powers Supabase's features such as: Issuing JWTs Row Level Security with PostgREST User management Sign in with email, password, magic link, phone number Sign in with...

CVE-2025-63572

Description A SQL injection vulnerability was discovered in the endpoint responsible for searching for platform clients Zentrajuris v.1.0. User input sent to the search parameter is concatenated directly into a SQL query without proper sanitization/parameterization, allowing the attacker to...

CVE-2026-116674 vulnerabilities

Vulnerabilities for packages: supabase-storage-api, supabase-storage-api-fips, opentelemetry-auto-instrumentations-node...

GHSA-7648-JMWF-VW7J vulnerabilities

Vulnerabilities for packages: supabase-storage-api, supabase-storage-api-fips, opentelemetry-auto-instrumentations-node...

GHSA-RMXM-3FG6-PX4F vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, langfuse-fips, opensearch-dashboards, langfuse, supabase-fips, supabase, kibana...

CVE-2026-118663 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, langfuse-fips, opensearch-dashboards, langfuse, supabase-fips, supabase, kibana...

CVE-2026-116576 vulnerabilities

Vulnerabilities for packages: supabase-storage-api, supabase-storage-api-fips, homepage, opentelemetry-auto-instrumentations-node...

CVE-2026-116673 vulnerabilities

Vulnerabilities for packages: supabase-storage-api, supabase-storage-api-fips, homepage, opentelemetry-auto-instrumentations-node...

GHSA-3F7J-7JWC-FXFJ vulnerabilities

Vulnerabilities for packages: supabase-storage-api, supabase-storage-api-fips, homepage, opentelemetry-auto-instrumentations-node...

GHSA-4VJG-VX72-QQ4G vulnerabilities

Vulnerabilities for packages: supabase-storage-api, supabase-storage-api-fips, homepage, opentelemetry-auto-instrumentations-node...

GHSA-MCHM-GJX6-7H55 vulnerabilities

Vulnerabilities for packages: langfuse-fips, langfuse, supabase...

CVE-2026-114139 vulnerabilities

Vulnerabilities for packages: langfuse-fips, langfuse, supabase...

CVE-2026-54238

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects an expired integer exp token signed wit...

CVE-2026-54238

Prior to version 2.103.1 , Supabase Realtime REST broadcast endpoints incorrectly accepted expired JWTs when the exp claim was encoded as a JSON string instead of a JSON number. While the system correctly rejected expired tokens with integer claims, the string-based encoding flaw allowed an unaut...

CVE-2026-54238 Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects an expired integer exp token signed wit...

CVE-2026-54238 Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects an expired integer exp token signed wit...

EUVD-2026-108263

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects an expired integer exp token signed wit...