SurrealDB versions prior to 3.1.0 contain a defect in the JWT access method configuration that silently substitutes the ES512 algorithm with ES384 when a user configures ALGORITHM ES512. Because the underlying jsonwebtoken crate has no ES512 variant, the mapping defaults to ES384 without emitting any error, warning, or log message. Users who supply the appropriate P‑521 key for ES512 therefore experience authentication handshake failures due to the curve mismatch with ES384, which expects a P‑384 key, and the generated tokens are rejected by external systems that expect genuine ES512 signatures. The flaw does not allow an attacker to forge tokens or compromise the confidentiality or integrity of data, as ES384 remains cryptographically strong. The primary consequence is that legitimate authentication attempts may fail or tokens may be invalidated by third‑party consumers.

The affected product is SurrealDB. All releases before version 3.1.0 are impacted, regardless of the configuration language used for JWT access methods. Upgrading to any 3.1.0 or later release eliminates the silent algorithm downgrade. No other products or vendors are listed as affected.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. The likelihood of exploitation is low because the issue is purely a configuration error that leads to authentication failures rather than privilege escalation or data compromise. An attacker would need to have an understanding of the JWT configuration and would not gain any additional authority. Based on the description, the likely attack vector is through misconfiguration during deployment rather than via remote code execution or other direct exploitation pathways.