<![CDATA[Over 16,000 Supabase databases expose PII, passwords, auth tokens]]>Researchers have identified a large-scale exposure issue affecting applications built on Supabase, the open-source Firebase alternative. More than 16,000 misconfigured Supabase databases were found to be publicly accessible, with readable tables containing personally identifiable information, passwords, or authentication tokens.

The root cause is misconfiguration rather than a flaw in Supabase itself. When developers set up their projects without properly enabling Row Level Security and related access controls, the underlying database tables can be queried by anyone who knows or guesses the project endpoint. In these cases, sensitive records become readable without authentication.

Key points from the research:

  • Over 16,000 databases were found exposed due to misconfiguration
  • Exposed data includes PII, passwords, and auth tokens
  • The issue stems from improperly secured Supabase projects, not a vulnerability in the platform

If you operate a Supabase-backed application, it is worth verifying that Row Level Security is enabled on all tables and that your API keys and access policies are scoped correctly. Exposed credentials and tokens should be rotated promptly if any leak is suspected.

Source: BleepingComputer

Have you checked whether your organization's Supabase projects have RLS properly enforced on every table?

]]>https://xploitlk.com/topic/500/over-16-000-supabase-databases-expose-pii-passwords-auth-tokensRSS for NodeTue, 27 Oct 2026 08:20:38 GMTTue, 29 Sep 2026 02:30:22 GMT60