PT-2026-24743 · Git+1 · Auth

Fadymak · Published 2026-03-11 · Updated 2026-03-12 · CVE-2026-31813

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Supabase Auth versions prior to 2.185.0

Description Supabase Auth is a JWT based API used for managing users and issuing JWT tokens. A flaw exists where an attacker can create sessions for any user by using specially crafted ID tokens when Apple or Azure providers are enabled. The attacker sends a valid, asymmetrically signed ID token to the Supabase Auth token endpoint using the ID token flow. If the ID token conforms to OIDC standards, the Auth server validates it against the attacker’s issuer, linking the victim’s existing OIDC identity (Apple or Azure) to a new OIDC identity based on the token’s content. This allows the attacker to obtain a valid user session, including access and refresh tokens, at the AAL1 level.

Recommendations Versions prior to 2.185.0 should be updated to version 2.185.0 or later.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2026-31813

GHSA-V36F-QVWW-8W8M

Affected Products

Auth

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31813.json · Exploit
• https://github.com/supabase/auth/security/advisories/GHSA-v36f-qvww-8w8m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31813 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31813 · Security Note
• https://twitter.com/CVEnew/status/2031992410969080071 · Twitter Post
• https://t.me/CVEtracker/47150 · Telegram Post
• https://twitter.com/infoflowcloud/status/2031994028648956189 · Twitter Post