SurrealDB versions prior to 3.1.0 fail to refresh authentication state for LIVE SELECT subscriptions when the session changes, allowing an attacker to continue receiving real‑time notifications even after the session has been revoked or expired. This flaw represents an authentication bypass that can expose data that should no longer be accessible, and it maps to CWE‑613, the weakness of improper authentication state management.

All installations of SurrealDB older than version 3.1.0 are vulnerable. This includes any deployment that uses live query subscriptions with session authentication.

The CVSS score of 5.3 indicates a moderate impact. Based on the description, it can be inferred that the exploit requires the attacker to maintain an open live query connection; this suggests the attack does not need sophisticated tooling but also is not trivial. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalogue, suggesting no widespread active exploitation is currently documented. Nevertheless, an attacker who can establish a live subscription prior to session revocation can receive continued access to sensitive data until the connection is closed.