Skip to content
OpenAdvisories

Vendor

supabase

4 known vulnerabilities.

Products

realtime 2 auth-js 1 auth 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 3.1
    CVE-2026-54238

    Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization

    Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects a…

    supabase realtime
  • Low 2.7
    CVE-2025-48370

    auth-js Vulnerable to Insecure Path Routing from Malformed User Input

    auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.70.0, the library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not require the user supplied values to be valid UUIDs. This could lead to …

    supabase auth-js @supabase/auth-js npm