27 matches found
auth
Auth - Аутентификация и управление пользователями от Supabase Auth — это сервер аутентификации и управления пользователями, написанный на Go, который обеспечивает работу таких функций Supabase, как: Выпуск JWT Безопасность на уровне строк Row Level Security с PostgREST Управление пользователями...
ANT-2026-96NHD13X · supabase/auth · auth-bypass
auth-bypass low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-96NHD13X: Factor-type string mismatch prevents session AAL downgrade In supabase/auth, DowngradeSessionsToAAL...
ANT-2026-CGR7Y3J8 · supabase/auth · other
other low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-CGR7Y3J8: OAuth authorization code single-use not enforced atomically In the authorizationcode grant handler of the...
ANT-2026-XJKJSANG · supabase/auth · other
other low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-XJKJSANG: Azure issuer check uses always-true boolean expression In the Azure external auth provider azure.go:72, t...
ANT-2026-0JJXMV3G · supabase/auth · privilege-escalation
privilege-escalation medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-0JJXMV3G: Passkey registration requires no step-up authentication The POST...
ANT-2026-7WJV60DR · supabase/auth · other
other medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-7WJV60DR: Manual identity linking enables account takeover via unverified email When...
ANT-2026-BVDWY3J9 · supabase/auth · open-redirect
open-redirect medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-BVDWY3J9: Redirect allow-list ignores URL scheme and port In supabase/auth, IsRedirectURLValid...
ANT-2026-GQ8G77M4 · supabase/auth · broken-access-control
broken-access-control medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-GQ8G77M4: Banned users retain authenticated endpoint access maybeLoadUserOrSession in...
ANT-2026-CT4ZXP4Z · supabase/auth · privilege-escalation
privilege-escalation medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-CT4ZXP4Z: Parent refresh token of post-MFA token yields AAL2 without MFA In supabase/auth's...
ANT-2026-J5P6B5WQ · supabase/auth · other
other medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-J5P6B5WQ: Banned user obtains fresh sessions via identity linking In internal/api/identity.go,...
Auth 授权问题漏洞
Auth is a user authentication and management system open sourced by Supabase. There were vulnerabilities related to authorization in versions of Auth from 1.18.0 to 1.25.2, and from 2.0.0 to 2.1.2. This vulnerability stemmed from the Patreon OAuth provider, which mapped all authenticated Patreon...
CVE-2026-31813
Supabase Auth is a JWT based API for managing users and issuing JWT tokens. Prior to 2.185.0, a vulnerability has been identified that allows an attacker to issue sessions for arbitrary users using specially crafted ID tokens when the Apple or Azure providers are enabled. The attacker issues a...
CVE-2026-31813 Supabase Auth has insecure Apple and Azure authentication with ID tokens
Supabase Auth is a JWT based API for managing users and issuing JWT tokens. Prior to 2.185.0, a vulnerability has been identified that allows an attacker to issue sessions for arbitrary users using specially crafted ID tokens when the Apple or Azure providers are enabled. The attacker issues a...
CVE-2026-31813
CVE-2026-31813 affects Supabase Auth. Before version 2.185.0, if Apple or Azure as OIDC providers are enabled, an attacker can create a valid, asymmetrically signed ID token from their issuer for each victim email and send it to the token endpoint using the ID token flow. If the ID token is OIDC ...
CVE-2026-31813 Supabase Auth has insecure Apple and Azure authentication with ID tokens
Supabase Auth is a JWT based API for managing users and issuing JWT tokens. Prior to 2.185.0, a vulnerability has been identified that allows an attacker to issue sessions for arbitrary users using specially crafted ID tokens when the Apple or Azure providers are enabled. The attacker issues a...
CVE-2026-31813 Supabase Auth has insecure Apple and Azure authentication with ID tokens
Supabase Auth is a JWT based API for managing users and issuing JWT tokens. Prior to 2.185.0, a vulnerability has been identified that allows an attacker to issue sessions for arbitrary users using specially crafted ID tokens when the Apple or Azure providers are enabled. The attacker issues a...
CVE-2026-31813
Supabase Auth is a JWT based API for managing users and issuing JWT tokens. Prior to 2.185.0, a vulnerability has been identified that allows an attacker to issue sessions for arbitrary users using specially crafted ID tokens when the Apple or Azure providers are enabled. The attacker issues a...
Auth 安全漏洞
Auth is a user authentication and management system developed by Supabase. Previous versions of Supabase Auth, such as 2.185.0, had security vulnerabilities. These vulnerabilities occurred when Apple or Azure providers were enabled, allowing attackers to issue session tokens for arbitrary users...