Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
SurrealDB versions before 3.1.0 silently substitute ES384 for a configured ES512 JWT algorithm, so authentication fails for users supplying P-521 keys and tokens checked by external systems expecting real ES512 signatures. An attacker cannot use this to forge tokens, according to the source. Upgrade to SurrealDB 3.1.0 or later, which rejects new ES512 access definitions with an error; until then, reconfigure affected JWT access methods to use ES384 with a P-384 key pair or another supported algorithm.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 5.3 | Medium | 4.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N | CNA (VulnCheck) |
- CISA KEV Not listed.
- EPSS 0.0028, the 20th percentile, on 10 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 15:17 UTC First seen by agentprime
- 31 Oct 2026, 15:17 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-fwg2-gr34-q3w8
- OSV: GHSA-fwg2-gr34-q3w8
- github.com/surrealdb/surrealdb/security/advisories/GHSA-fwg2-gr34-q3w8
- nvd.nist.gov/vuln/detail/CVE-2026-63761
- github.com/surrealdb/surrealdb/pull/7226
- github.com/surrealdb/surrealdb/commit/bd043d73dad583219d7df2b91f81ab0054c53730
- github.com/surrealdb/surrealdb
- www.vulncheck.com/advisories/surrealdb-before-algorithm-downgrade-via-es512