SurrealDB before 1.5.4 Authentication Bypass via Database Switch

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2024-58363 · Microsoft / collected KEV context

EUVD-2024-55679

GHSA-hgp5-pm7v-q8vg

GHSA-gh9f-6xm2-c4j2

cve-program · CVE-2024-58363

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-gh9f-6xm2-c4j2
• https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-database-switch

euvd · EUVD-2024-55679

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-gh9f-6xm2-c4j2
• https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-database-switch

nvd · CVE-2024-58363

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-gh9f-6xm2-c4j2
• https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-database-switch

osv · GHSA-gh9f-6xm2-c4j2

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-gh9f-6xm2-c4j2
• https://github.com/surrealdb/surrealdb/pull/4335
• https://github.com/surrealdb/surrealdb/commit/492f8378d57968dbdf5e63fad41b6ff59bba0b80
• https://github.com/surrealdb/surrealdb

osv · GHSA-hgp5-pm7v-q8vg

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-gh9f-6xm2-c4j2
• https://nvd.nist.gov/vuln/detail/CVE-2024-58363
• https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-database-switch

• SurrealDB before 1.5.4 Authentication Bypass via Database Switch · Affected-version evidence changed · 29 Oct 2026
• SurrealDB before 1.5.4 and 2.0.0-alpha.1 before 2.0.0-alpha.6 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unre… · Advisory content revised · 29 Oct 2026