Description
SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privilege token for the same access method and a victim's mcp-session-id can hijack the session and execute MCP tools with the victim's roles and permissions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| surrealdb | surrealdb | 3.1.0 – < 3.3.0 | 3.3.0 |
References
- GitHub Security Advisory (GHSA-pgh9-49q4-hqcx) vendor-advisory
- VulnCheck Advisory: SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision third-party-advisory