SurrealDB versions before 3.1.0 contain a session hijacking flaw. The /rpc sessions method exposes session UUIDs without requiring authentication and accepts arbitrary session fields without verifying ownership. Attackers can enumerate these UUIDs and impersonate authenticated sessions, allowing them to read, write, delete data and elevate privileges within the database. This weakness matches CWE‑306.

All deployments of SurrealDB under the surrealdb:surrealdb product line with any version older than 3.1.0 are affected, regardless of network isolation, because the /rpc endpoint is reachable without authentication.

The CVSS score of 8.7 classifies the vulnerability as high severity. Although the EPSS score is less than 1%, indicating a low probability of public exploitation, the flaw permits a complete takeover of database sessions through simple HTTP requests to a publicly accessible endpoint. Based on the description, the likely attack vector is unauthenticated HTTP requests to the /rpc endpoint. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by first requesting /rpc sessions to harvest UUIDs and then forging subsequent authenticated requests that use those identifiers, effectively bypassing authentication and escalating privileges.