realtime vulnerabilities
CVEs whose affected-version data names the realtime package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-54238Low· 3.1Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization
Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. Th…
▾ Sunlitsupabase · realtimeEPSS 0.21%via CVEORG
CVE-2026-62247Medium· 6.5Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets
Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel clien…
▾ Sunlitsupabase · realtimeEPSS 0.45%via NVD