supabase auth vulnerabilities

Latest supabase auth CVEs

Newest publication first

1. CVE-2026-31813 Supabase Auth has insecure Apple and Azure authentication with ID tokens

   Published 2026-03-11

   Medium·CVSS 4.8 EPSS 0.16%

   Supabase Auth is a JWT based API for managing users and issuing JWT tokens. Prior to 2.185.0, a vulnerability has been identified that allows an attacker to issue sessions for arbitrary users using specially crafted ID tokens when the Apple or Azure providers are enabled. The att...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.