supabase CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

LOW supabase CVE published 2026-10-22

CVE-2026-54238

A vulnerability in Supabase Realtime allows unauthenticated broadcast of realtime messages to subscribers due to acceptance of expired JWTs with string exp claims. This issue is patched in version 2.103.1. The vulnerability arises from the REST broadcast endpoints accepting an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. This allows an unauthenticated attacker to br [truncated]