Duplicate Advisory: SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation

SurrealDB prior to version 3.1.0 has a vulnerability where configuring JWT access with the ES512 algorithm results in a silent fallback to the ES384 algorithm. This behavior stems from the jsonwebtoken crate (v10.x) lacking an ES512 variant, causing the system to default to ES384 without any error or warning. Consequently, users providing a P-521 key for ES512 face authentication failures due to curve mismatches, and tokens signed with ES512 are rejected by external systems expecting genuine ES512 signatures. The flaw does not enable token forgery or compromise the cryptographic strength of the system since ES384 remains secure.

The vulnerability leads to authentication handshake failures and token rejection in systems expecting ES512 signatures. There is no impact on data confidentiality or integrity, and no ability to forge tokens. Availability impact is limited to authentication failures.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid configuring JWT access with ES512 on affected SurrealDB versions prior to 3.1.0 or monitor for updates that address this issue.