Supabase Realtime v2.103.0 or earlier incorrectly accepts expired JSON Web Tokens when the "exp" claim is encoded as a JSON string rather than a numeric value; this bypasses token expiration checks and allows any attacker to send broadcasts to connected clients. The vulnerability is an authentication bypass (CWE-613) and its primary consequence is that unauthenticated parties can inject arbitrary realtime events into the application channel.

Affected systems include all deployments of the Supabase Realtime server running any version prior to 2.103.1, regardless of the tenant or projects configured within the instance. The flaw is present in the REST broadcast endpoint used for broadcast, presence, and Postgres change notifications.

The risk assessment notes a low CVSS score of 3.1 and no EPSS data; the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires simply sending an HTTP request to the broadcast endpoint using a token whose "exp" field is a string; no authentication is required beyond supplying the expired token and the target tenant secret. The attack can originate from the internet or internally if the broadcast endpoint is exposed, making it a potential vector for targeted applications that rely on realtime delivery.