CVE-2026-54238

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects an expired integer exp token signed wit...

CVE-2026-54238

Prior to version 2.103.1 , Supabase Realtime REST broadcast endpoints incorrectly accepted expired JWTs when the exp claim was encoded as a JSON string instead of a JSON number. While the system correctly rejected expired tokens with integer claims, the string-based encoding flaw allowed an unaut...

CVE-2026-54238 Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects an expired integer exp token signed wit...

CVE-2026-54238 Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects an expired integer exp token signed wit...

EUVD-2026-108263

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects an expired integer exp token signed wit...

CVE-2026-54238 Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects an expired integer exp token signed wit...

Supabase Realtime session mechanism vulnerability

Versions of Supabase Realtime prior to 2.103.1 contain a vulnerability related to the session mechanism. This vulnerability arises because the REST broadcast endpoint accepts expired JWTs when the exp value is encoded as a JSON string rather than a JSON number. As a result, unauthenticated...

PT-2026-121490

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects an expired integer exp token signed wit...

CVE-2026-62247

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

CVE-2026-62247 Supabase Realtime: Incorrect Authorization

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

CVE-2026-62247 Supabase Realtime: Incorrect Authorization

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

CVE-2026-62247

Supabase Realtime (prior to 2.111.2 ) contains an incorrect authorization flaw in its per-extension presence.read row-level security (RLS) policy enforcement. When a private-channel client is granted presence.write but explicitly denied presence.read , the client can still receive presence_diff m...

EUVD-2026-84066

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

CVE-2026-62247 Supabase Realtime: Incorrect Authorization

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

CVE-2026-62247

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

PT-2026-96235

Name of the Vulnerable Software and Affected Versions Supabase Realtime versions prior to 2.111.2 Description Realtime authorization fails to correctly honor the per-extension presence.read row-level security policy. This occurs when a private-channel client is granted presence.write permissions...

CVE-2026-62247: Incorrect Authorization

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...