Skip to content
OpenAdvisories

Product · supabase

realtime

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.1
    CVE-2026-54238

    Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization

    Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. The same route rejects a…

    supabase realtime