PatchSiren cyber security CVE debrief
CVE-2026-63761 surrealdb CVE debrief
CVE-2026-63761 is a medium-severity vulnerability affecting SurrealDB before version 3.1.0. The issue arises when a JWT access method is configured with the ES512 algorithm, which is silently substituted with ES384 due to limitations in the underlying jsonwebtoken crate. This substitution leads to authentication handshake failures for users who provide the correct P-521 key for ES512, as ES384 expects a P-384 key. Consequently, tokens are rejected by external systems expecting genuine ES512 signatures. However, this flaw does not enable token forgery or compromise data confidentiality and integrity, as ES384 remains cryptographically strong.
- Vendor
- surrealdb
- Product
- Unknown
- CVSS
- MEDIUM 5.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-20
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-07-20
- Advisory updated
- 2026-07-22
Who should care
Users of SurrealDB versions prior to 3.1.0 who utilize JWT access methods with the ES512 algorithm should be aware of this vulnerability. Although it does not allow for token forgery or data compromise, it may cause authentication issues with external systems expecting ES512 signatures.
Technical summary
The vulnerability is caused by the jsonwebtoken crate (version 10.x) used by SurrealDB, which lacks support for the ES512 algorithm. When ES512 is specified, it defaults to ES384 without notification, leading to a curve mismatch when using the correct P-521 key for ES512. This results in authentication failures and token rejection by systems expecting ES512 signatures. The issue is resolved in SurrealDB version 3.1.0.
Defensive priority
Medium priority should be given to updating SurrealDB to version 3.1.0 or later. In the meantime, users should verify their configurations and prepare for potential authentication issues with external systems.
Recommended defensive actions
- Update SurrealDB to version 3.1.0 or later
- Verify JWT access method configurations for ES512 algorithm usage
- Prepare for potential authentication issues with external systems expecting ES512 signatures
- Monitor for security advisories and updates from SurrealDB
- Confirm whether affected SurrealDB deployments exist in managed environments and assign an owner for follow-up
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
Evidence notes
The CVE record was published on 2026-07-20T12:19:46.330Z and was last modified on 2026-07-21T18:37:56.803Z. The NVD entry is currently Awaiting Analysis. References include the CVE.org record, NVD detail page, and source references from Vulncheck.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-20T12:19:46.330Z and has not been modified since then. The NVD entry is currently Awaiting Analysis.