auth

Auth - Supabase의 인증 및 사용자 관리 Auth는 Go로 작성된 사용자 관리 및 인증 서버로서, Supabase의 다음과 같은 기능을 지원합니다: JWT 발급 PostgREST를 통한 행 수준 보안 사용자 관리 이메일, 비밀번호, 매직 링크, 전화번호로 로그인 외부 제공자Google, Apple, Facebook, Discord, ...로 로그인 이 프로젝트는 원래 Netlify의 GoTrue 코드베이스를 기반으로 하였지만, 두 프로젝트는 기능과 역량에서 크게 분기되었습니다. 프로젝트에 기여하려면 기여 가이드를...

CVE-2025-51862

CVE-2025-51862 취약점 설명 TelegAI는 AI 캐릭터를 구축하고 채팅할 수 있는 웹 애플리케이션으로, 채팅 구성 요소에 IDORInsecure Direct Object Reference, 안전하지 않은 직접 객체 참조 취약점이 존재합니다. 공격자는 이 IDOR을 악용하여 다른 사용자의 대화를 변조할 수 있습니다. 또한 악성 콘텐츠와 XSS 페이로드를 주입할 수 있어, 피싱 공격, 사용자 사칭 및 XSS를 통한 계정 탈취로 이어질 수 있습니다. 공격 벡터 TelegAI는 대화 API가 처리되는 방식과 관련하여 안전...

supahunter

Supabase Hunter OP Mode Supabase 인스턴스를 위한 고급 정찰 및 익스플로잇 도구. SupaHunter는 오설정된 Supabase 프로젝트를 식별, 분석 및 익스플로잇하기 위해 설계된 강력한 Python 도구입니다. 단순한 테이블 열거를 넘어, 심층 검사 기능, Selenium 기반 키 추출, 고급 권한 상승 검사를 제공합니다. 주요 기능 고급 발견: OpenAPI 검사: /rest/v1/을 자동으로 가져와 파싱하여 전체 데이터베이스 스키맵을 매핑합니다. RPC 열거: 숨겨진 RPC 함수getschema...

CVE-2025-63572

설명 SQL 인젝션 취약점이 플랫폼 클라이언트 검색을 담당하는 엔드포인트Zentrajuris v.1.0에서 발견되었습니다. 검색 매개변수로 전송된 사용자 입력은 적절한 살균/파라미터화 없이 SQL 쿼리에 직접 연결되어, 공격자가 쿼리를 조작할 수 있게 합니다. 영향을 받는 엔드포인트 iqopgbljnxmxlzvzbvgy.supabase.co/rest/v1/clients 페이로드 예시 파라미터 ?select=&limit=100 을 추가하고 Accept 헤더를 application/json으로 변경하세요. 개념 증명 PoC 영향 ...

CVE-2026-103255

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to...

CVE-2026-103248

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters String mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update...

CVE-2026-103255 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to...

CVE-2026-103255 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to...

CVE-2026-103255

Versions of n8n prior to 1.123.80, and from 2.0.0 before 2.39.6 and from 2.40.0 before 2.40.1, are vulnerable to a path traversal and query injection flaw in the Supabase node . The root cause is the lack of validation when the tableId parameter is inserted into request paths. Attackers can explo...

EUVD-2026-90649

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to...

CVE-2026-103248 n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters String mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update...

CVE-2026-103248 n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters String mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update...

CVE-2026-103248

The n8n workflow automation tool is vulnerable to a filter injection vulnerability in the Supabase node 's Filters (String) mode. The flaw exists because the application fails to escape field values, allowing attackers to inject filter expressions from untrusted input. Impacted versions include t...

CVE-2026-103248 n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters String mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update...

EUVD-2026-90642

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters String mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update...

PT-2026-103788

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.80 n8n versions 2.0.0 through 2.39.5 n8n versions 2.40.0 Description A path traversal issue exists in the Supabase node where the tableId parameter is inserted into request paths without proper validation. This allo...

CVE-2026-103255: External Control of File Name or Path

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to...

CVE-2026-103248: Improper Neutralization of Special Elements used in an SQL Command

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters String mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update...

CVE-2026-100627

Capgo Cap-go/capgo.app server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, available to "all" and "write" API keys, dispatches to setChannel, which authorizes with checkPermissionc, 'channel.promotebundle', appI...

CVE-2026-100623

Capgo capgo.app exposes the legacy membership table public.orgusers directly through Supabase PostgREST. The table's row-level security policies "Allow org admin to insert" and "Allow org admin to update" only verify that the caller has admin rights in the target organization...