ANT-2026-66X46XSC · supabase/supabase · other

insecure-config low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-66X46XSC: X-Content-Type-Options header set to invalid value The Next.js headers configuration for the...

ANT-2026-EFRBDRNP · supabase/supabase · open-redirect

open-redirect low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-EFRBDRNP: Unvalidated returnTo redirect after organisation creation In Supabase Studio's NewOrgForm...

ANT-2026-AM0R21ZY · supabase/supabase · broken-access-control

broken-authorization medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-AM0R21ZY: HIPAA sensitive-project AI block enforced only client-side The client hook...

ANT-2026-SXD0NN2P · supabase/supabase · SQL Injection

query-injection high Severity Claude high · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-SXD0NN2P: Link-driven SQL injection via table-editor filter ARRAY bypass The Supabase Studio Table Edit...

ANT-2026-MEXHXGNE · supabase/supabase · SQL Injection

query-injection high Severity Claude high · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-MEXHXGNE: Link-driven SQL injection via schema URL parameter Supabase Studio reads the ?schema= URL...

Supabase Studio Panel - Detect

Supabase Studio login panel was detected. The admin dashboard shipped with Supabase, the popular open-source Firebase alternative Postgres + auth + realtime + storage + edge functions. !/usr/bin/env python3 -- coding: utf-8 -- """Supabase Studio login panel was detected.""" from kittysploit impor...