Supabase Auth is a JWT-based authentication API that manages user sessions and issues tokens. The vulnerability CVE-2026-31813 arises when the Apple or Azure OpenID Connect (OIDC) providers are enabled in versions before 2.185.0. The flaw allows an attacker to create a specially crafted ID token signed by their own issuer, which is accepted by the Supabase Auth server if it complies with OIDC standards. The server erroneously validates this token against the attacker-controlled issuer and links the victim's existing OIDC identity to this malicious token. Consequently, the attacker can generate valid user sessions for arbitrary users without possessing their credentials, effectively bypassing authentication. This attack leverages the trust model of OIDC and the improper issuer validation logic in Supabase Auth. The attacker gains access tokens and refresh tokens at Authentication Assurance Level 1 (AAL1), enabling session hijacking or impersonation. The vulnerability requires no user interaction or prior authentication but demands the attacker to generate valid OIDC-compliant tokens from their own issuer. The issue is resolved in Supabase Auth version 2.185.0 by correcting the issuer validation and identity linking logic. No public exploits have been reported, and the CVSS v3.1 score is 4.8, reflecting medium severity due to the attack complexity and limited scope of impact.

This vulnerability allows attackers to impersonate any user in affected Supabase Auth deployments, potentially gaining unauthorized access to user accounts and sensitive data. Organizations using Supabase Auth with Apple or Azure OIDC providers enabled are at risk of session hijacking and unauthorized resource access. The impact includes loss of confidentiality and integrity of user data and sessions, undermining trust in the authentication system. Although the attack does not directly affect availability, compromised sessions can lead to further exploitation or lateral movement within applications. The medium CVSS score reflects that exploitation requires crafting valid tokens and some technical skill, limiting widespread automated attacks. However, targeted attacks against high-value users or sensitive applications could have significant consequences, including data breaches, account takeover, and compliance violations. Organizations relying on Supabase Auth for critical authentication should consider this a serious risk until patched.

Upgrade Supabase Auth to version 2.185.0 or later immediately to apply the fix that corrects the issuer validation and identity linking logic. Until patching is possible, disable the Apple and Azure OIDC providers if feasible to prevent exploitation. Implement additional monitoring and alerting on authentication anomalies, such as unexpected token issuances or session creations for high-privilege accounts. Employ multi-factor authentication (MFA) at higher assurance levels to reduce the impact of compromised sessions. Review and restrict token issuance policies and validate OIDC issuer configurations carefully. Conduct regular security assessments and penetration testing focused on authentication flows. Educate developers and administrators about the risks of improper token validation and the importance of keeping authentication libraries up to date. Consider implementing anomaly detection systems that can flag unusual login patterns or token usage.