# SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers

SurrealDB HTTP /rpc `sessions` method leaked attached session UUIDs unauthenticated, and /rpc accepted any `session` field without ownership checks, letting anonymous callers hijack authenticated sessions.

- Payout: Research
- Severity: high
- Program: SurrealDB
- Found by: addcontent
- Disclosed: 2026-07-01
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-5qfp-32cf-69jh
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-5qfp-32cf-69jh
- Tags: area:web domain:api impact:ato impact:privesc kind:research platform:ghsa sev:high tech:rust technique:source-review vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** HTTP /rpc endpoint (sessions method and session field)
**Root cause:** The HTTP `sessions` RPC method returned all attached session UUIDs without authentication, and the `/rpc` handler accepted a client-supplied `session` field without verifying it belonged to the caller's auth principal.
**Steps:**
1. Identify a SurrealDB instance exposing HTTP `/rpc` where clients use `attach` (e.g. Rust SDK Http/Https engine).
2. Call `{"method":"sessions"}` on `/rpc` unauthenticated to enumerate attached session UUIDs.
3. Send a `/rpc` request including the stolen UUID in the `session` field; no ownership check is performed.
4. Operate with the hijacked session's privileges (read/write/delete data, up to root).
**How found:** Reporter observed that the `sessions` RPC method exposed attached session UUIDs and that the `/rpc` handler trusted client-supplied session IDs without binding them to the request's auth principal.
**Exploitation:** Anonymous attacker enumerates attached session UUIDs via the unauthenticated `sessions` method, then supplies a victim UUID in the `session` field of any `/rpc` call to inherit that session's authenticated privilege level and access its data.
**Escalation:** Hijacking a session attached at root level yields full administrative control; attacker can also invalidate sessions.
**Insight:** When a server exposes both a session-enumeration method and a client-supplied session identifier, check whether the identifier is bound to the caller's principal — session maps populated by `attach` are the high-value target, while ephemeral per-request sessions are filtered out.