SurrealDB Session Hijacking via Unauthenticated UUID Enumeration

SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

SurrealDB versions before 3.1.0 suffer from a critical session hijacking vulnerability that exposes authenticated sessions to complete compromise. The HTTP /rpc sessions method returns active session UUIDs without requiring authentication, while simultaneously accepting arbitrary session fields with no ownership verification. This means an unauthenticated attacker can enumerate valid session identifiers and assume the identity of legitimate users, gaining full access to read, modify, and delete database records while potentially escalating to administrative privileges. Organizations running vulnerable SurrealDB instances face immediate risk of unauthorized data access, data manipulation, and privilege escalation attacks that leave minimal forensic traces.

Casky's 283 matching security skills leverage Claude AI's extended reasoning to detect attack patterns across MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify suspicious patterns including: unauthenticated requests to the /rpc sessions endpoint showing unusual enumeration activity (CWE-306: Missing Authentication), detection of session UUID patterns being tested across multiple requests, anomalous session field modifications from previously unseen sources, and privilege escalation indicators where low-privileged operations suddenly execute high-privileged commands within hijacked sessions. The platform's skills would correlate these behavioral signals to flag both the reconnaissance phase (session enumeration) and exploitation phase (unauthorized session assumption and command execution), enabling defenders to distinguish legitimate session management from active exploitation attempts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-63757.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-63757

Casky has 283 skills that investigate the attack patterns behind CVE-2026-63757. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn