CyberRota Analysis
AI-GeneratedSurrealDB versions prior to 3.1.0 are vulnerable to a time-of-check/time-of-use race condition in the HTTP /rpc endpoint, enabling unauthenticated attackers to exploit concurrent requests and inherit authenticated session states. This flaw allows attackers to perform operations with the privileges of legitimate users, posing a significant risk to data integrity and confidentiality. Organizations using affected versions should prioritize patching to mitigate the potential for unauthorized access and privilege escalation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated requests to inherit authenticated session state. Unauthenticated attackers can send concurrent requests to the /rpc endpoint while legitimate authenticated traffic is active to execute operations with hijacked user privileges.
Related CVEs
Other vulnerabilities affecting the same vendor(s)