Search
Find a vulnerability
Search criteria
8 vulnerabilities found for supertokens-core by supertokens
CVE-2026-123804 (GCVE-0-2026-123804)
Vulnerability from cvelistv5 – Published: 2026-11-09 18:53 – Updated: 2026-11-09 18:53
VLAI
EPSS
VEX
Title
SuperTokens Core: A session created concurrently with account unlink survives the unlink
Summary
SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated and revoked the existing sessions. A user who controls the linked login method can exploit this race to retain a signed, database-backed, refreshable session as the former primary identity after that method is unlinked; the session persists until expiry or explicit revocation. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Severity
6.8 (Medium)
CWE
Assigner
GitHub_M
CNA
References
21 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| supertokens | supertokens-core |
Affected:
>= 7.0.0, < 11.0.0
Affected: >= 11.0.0, < 11.0.9 Affected: >= 11.1.0, < 11.1.4 Affected: >= 11.2.0, < 11.2.4 Affected: >= 11.3.0, < 11.3.8 Affected: >= 11.4.0, < 11.4.8 Affected: >= 12.0.0, < 12.0.11 Affected: >= 12.1.0, < 12.1.2 Affected: >= 12.2.0, < 12.2.1 Affected: >= 12.3.0, < 12.3.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "supertokens-core",
"vendor": "supertokens",
"versions": [
{
"status": "affected",
"version": "\u003e= 7.0.0, \u003c 11.0.0"
},
{
"status": "affected",
"version": "\u003e= 11.0.0, \u003c 11.0.9"
},
{
"status": "affected",
"version": "\u003e= 11.1.0, \u003c 11.1.4"
},
{
"status": "affected",
"version": "\u003e= 11.2.0, \u003c 11.2.4"
},
{
"status": "affected",
"version": "\u003e= 11.3.0, \u003c 11.3.8"
},
{
"status": "affected",
"version": "\u003e= 11.4.0, \u003c 11.4.8"
},
{
"status": "affected",
"version": "\u003e= 12.0.0, \u003c 12.0.11"
},
{
"status": "affected",
"version": "\u003e= 12.1.0, \u003c 12.1.2"
},
{
"status": "affected",
"version": "\u003e= 12.2.0, \u003c 12.2.1"
},
{
"status": "affected",
"version": "\u003e= 12.3.0, \u003c 12.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated and revoked the existing sessions. A user who controls the linked login method can exploit this race to retain a signed, database-backed, refreshable session as the former primary identity after that method is unlinked; the session persists until expiry or explicit revocation. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613: Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T18:53:24.985Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-2pc4-vw9j-454c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-2pc4-vw9j-454c"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/182b39454ac44649cdef22d87f296a38a0b1a602",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/182b39454ac44649cdef22d87f296a38a0b1a602"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/378e1157dc26232a518d2c360ee60cf93c2fd8a2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/378e1157dc26232a518d2c360ee60cf93c2fd8a2"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/5aec64aca6d765cde491658210e6922e291742fd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/5aec64aca6d765cde491658210e6922e291742fd"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/b1c569ed59fffe16c2f657da1754abcae47d2761",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/b1c569ed59fffe16c2f657da1754abcae47d2761"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/b44f1e1418206f411e541501c2e5b9b147add0d9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/b44f1e1418206f411e541501c2e5b9b147add0d9"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/bb6d5f8d1b79770e3cc37f214ba94c3e36e9c3b8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/bb6d5f8d1b79770e3cc37f214ba94c3e36e9c3b8"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/c0b7f5eda20840f63f6b0f171d22bd49a7a609a1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/c0b7f5eda20840f63f6b0f171d22bd49a7a609a1"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/c8b48e843b323cd749dcb17b6b81c190e7882a43",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/c8b48e843b323cd749dcb17b6b81c190e7882a43"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/c950a01794cf0983ebd62412976cb80756bf5dd0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/c950a01794cf0983ebd62412976cb80756bf5dd0"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/d456dfbc02f2f7d68be7c05d876bdaa086f9a5b5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/d456dfbc02f2f7d68be7c05d876bdaa086f9a5b5"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/fc273f5157d3e96f147aa42773607d627d3b495f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/fc273f5157d3e96f147aa42773607d627d3b495f"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1"
}
],
"source": {
"advisory": "GHSA-2pc4-vw9j-454c",
"discovery": "UNKNOWN"
},
"title": "SuperTokens Core: A session created concurrently with account unlink survives the unlink"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-123804",
"datePublished": "2026-11-09T18:53:24.985Z",
"dateReserved": "2026-11-06T15:27:56.226Z",
"dateUpdated": "2026-11-09T18:53:24.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123803 (GCVE-0-2026-123803)
Vulnerability from cvelistv5 – Published: 2026-11-09 18:48 – Updated: 2026-11-09 23:01
VLAI
EPSS
VEX
Title
SuperTokens Core: WebAuthn sign-in accepts a passkey across tenant boundaries
Summary
SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform application-scoped WebAuthn lookups without constraining them to the requested tenant, and WebAuthN.signIn does not verify tenant membership. In a multi-tenant deployment using WebAuthn with a shared user pool, an ordinary user who possesses their own valid passkey in one tenant can submit its assertion to another tenant's sign-in endpoint in the same application and be authenticated there despite having no membership in the target tenant. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 23:00 UTC
Assigner
GitHub_M
CNA
References
18 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| supertokens | supertokens-core |
Affected:
>= 10.1.0, < 11.0.0
Affected: >= 11.0.0, < 11.0.9 Affected: >= 11.1.0, < 11.1.4 Affected: >= 11.2.0, < 11.2.4 Affected: >= 11.3.0, < 11.3.8 Affected: >= 11.4.0, < 11.4.8 Affected: >= 12.0.0, < 12.0.11 Affected: >= 12.1.0, < 12.1.2 Affected: >= 12.2.0, < 12.2.1 Affected: >= 12.3.0, < 12.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123803",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T23:00:35.473876Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T23:01:11.131Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "supertokens-core",
"vendor": "supertokens",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.1.0, \u003c 11.0.0"
},
{
"status": "affected",
"version": "\u003e= 11.0.0, \u003c 11.0.9"
},
{
"status": "affected",
"version": "\u003e= 11.1.0, \u003c 11.1.4"
},
{
"status": "affected",
"version": "\u003e= 11.2.0, \u003c 11.2.4"
},
{
"status": "affected",
"version": "\u003e= 11.3.0, \u003c 11.3.8"
},
{
"status": "affected",
"version": "\u003e= 11.4.0, \u003c 11.4.8"
},
{
"status": "affected",
"version": "\u003e= 12.0.0, \u003c 12.0.11"
},
{
"status": "affected",
"version": "\u003e= 12.1.0, \u003c 12.1.2"
},
{
"status": "affected",
"version": "\u003e= 12.2.0, \u003c 12.2.1"
},
{
"status": "affected",
"version": "\u003e= 12.3.0, \u003c 12.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform application-scoped WebAuthn lookups without constraining them to the requested tenant, and WebAuthN.signIn does not verify tenant membership. In a multi-tenant deployment using WebAuthn with a shared user pool, an ordinary user who possesses their own valid passkey in one tenant can submit its assertion to another tenant\u0027s sign-in endpoint in the same application and be authenticated there despite having no membership in the target tenant. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220: Insufficient Granularity of Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T18:48:51.355Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-6v34-w48w-44rc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-6v34-w48w-44rc"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/01ca34a06baa0d22db008f38c8eabd1f6695d9a6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/01ca34a06baa0d22db008f38c8eabd1f6695d9a6"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/030643edea5d69e0009ceeecbc5dd70be5c66186",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/030643edea5d69e0009ceeecbc5dd70be5c66186"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/1e3e4d9b25237a9c8fd77cbe0d4d0ecb360d8cd6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/1e3e4d9b25237a9c8fd77cbe0d4d0ecb360d8cd6"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/84492e38f9eb6db0cc338674ce5e94d1603bef08",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/84492e38f9eb6db0cc338674ce5e94d1603bef08"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/982d420a5ac29d5e362eaf39169a7a9f5339abeb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/982d420a5ac29d5e362eaf39169a7a9f5339abeb"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/a3d033022effb00ccf0c4ec6ca77c36eb1a24617",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/a3d033022effb00ccf0c4ec6ca77c36eb1a24617"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/ad768c1925e245930e5fbf9441452d85564de91d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/ad768c1925e245930e5fbf9441452d85564de91d"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/b933b6c9b4495e47a8b3efeb5a70e9d014777320",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/b933b6c9b4495e47a8b3efeb5a70e9d014777320"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/e19d173f47658d036685d3020e18819c5f3690b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/e19d173f47658d036685d3020e18819c5f3690b7"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1"
}
],
"source": {
"advisory": "GHSA-6v34-w48w-44rc",
"discovery": "UNKNOWN"
},
"title": "SuperTokens Core: WebAuthn sign-in accepts a passkey across tenant boundaries"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-123803",
"datePublished": "2026-11-09T18:48:51.355Z",
"dateReserved": "2026-11-06T15:27:56.226Z",
"dateUpdated": "2026-11-09T23:01:11.131Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123802 (GCVE-0-2026-123802)
Vulnerability from cvelistv5 – Published: 2026-11-09 18:23 – Updated: 2026-11-09 18:23
VLAI
EPSS
VEX
Title
SuperTokens Core SAML: identity taken from an assertion that never passed the audience check, allowing sign-in as any IdP user
Summary
SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, a licensed deployment with a configured SAML client can authenticate an identity from an assertion that did not satisfy the audience check. When the identity provider uses assertion-level signing, an attacker who has a still-valid IdP-signed assertion naming the victim for any audience and the attacker's own valid assertion for the target audience can combine them because validateSamlResponseAudience accepts an audience from one assertion while extractAllClaims takes the final NameID and attributes from another; response-level signing does not expose this multi-assertion variant. Independently, an assertion from an identity provider configured for the target deployment but issued to another SuperTokens deployment using the shared default saml_sp_entity_id can satisfy the target's audience check. Successful exploitation authenticates the attacker as the victim IdP user. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Severity
8.1 (High)
CWE
Assigner
GitHub_M
CNA
References
18 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| supertokens | supertokens-core |
Affected:
>= 11.3.0, < 11.3.8
Affected: >= 11.4.0, < 11.4.8 Affected: >= 12.0.0, < 12.0.11 Affected: >= 12.1.0, < 12.1.2 Affected: >= 12.2.0, < 12.2.1 Affected: >= 12.3.0, < 12.3.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "supertokens-core",
"vendor": "supertokens",
"versions": [
{
"status": "affected",
"version": "\u003e= 11.3.0, \u003c 11.3.8"
},
{
"status": "affected",
"version": "\u003e= 11.4.0, \u003c 11.4.8"
},
{
"status": "affected",
"version": "\u003e= 12.0.0, \u003c 12.0.11"
},
{
"status": "affected",
"version": "\u003e= 12.1.0, \u003c 12.1.2"
},
{
"status": "affected",
"version": "\u003e= 12.2.0, \u003c 12.2.1"
},
{
"status": "affected",
"version": "\u003e= 12.3.0, \u003c 12.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, a licensed deployment with a configured SAML client can authenticate an identity from an assertion that did not satisfy the audience check. When the identity provider uses assertion-level signing, an attacker who has a still-valid IdP-signed assertion naming the victim for any audience and the attacker\u0027s own valid assertion for the target audience can combine them because validateSamlResponseAudience accepts an audience from one assertion while extractAllClaims takes the final NameID and attributes from another; response-level signing does not expose this multi-assertion variant. Independently, an assertion from an identity provider configured for the target deployment but issued to another SuperTokens deployment using the shared default saml_sp_entity_id can satisfy the target\u0027s audience check. Successful exploitation authenticates the attacker as the victim IdP user. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220: Insufficient Granularity of Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T18:23:40.216Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-wfg2-vqfg-rqh6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-wfg2-vqfg-rqh6"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/00a15e045323ba8a566ca6f59b70125b4030ab6c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/00a15e045323ba8a566ca6f59b70125b4030ab6c"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/1645915320c5dfc22bce9029eb7d8364f8df402f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/1645915320c5dfc22bce9029eb7d8364f8df402f"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/1d0fd5b40848629295cf86d47be185f92f31e445",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/1d0fd5b40848629295cf86d47be185f92f31e445"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/324686349b21ab46fe465ca5f74294d6c68d3859",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/324686349b21ab46fe465ca5f74294d6c68d3859"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/53f42f496477e7cc3ccd48fe57851fa08d06a248",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/53f42f496477e7cc3ccd48fe57851fa08d06a248"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/5ffdd887b470035f409d61f85f2186381ad9cdd6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/5ffdd887b470035f409d61f85f2186381ad9cdd6"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/8e69a85e38709b832869c3bfc83df9a150d6f3cf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/8e69a85e38709b832869c3bfc83df9a150d6f3cf"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/a2483b692d43294fdb9ad2f8f6f831cca8300081",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/a2483b692d43294fdb9ad2f8f6f831cca8300081"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/b21760ceb5089b0fa30c8fd46f7bbfc680de56dd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/b21760ceb5089b0fa30c8fd46f7bbfc680de56dd"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/c77b13061176d9bd50ed24a9cf50ffbcdf332ee5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/c77b13061176d9bd50ed24a9cf50ffbcdf332ee5"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/f4ddc022ef1ee17933efb710c21a960cb4ada083",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/f4ddc022ef1ee17933efb710c21a960cb4ada083"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1"
}
],
"source": {
"advisory": "GHSA-wfg2-vqfg-rqh6",
"discovery": "UNKNOWN"
},
"title": "SuperTokens Core SAML: identity taken from an assertion that never passed the audience check, allowing sign-in as any IdP user"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-123802",
"datePublished": "2026-11-09T18:23:40.216Z",
"dateReserved": "2026-11-06T15:27:56.226Z",
"dateUpdated": "2026-11-09T18:23:40.216Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123801 (GCVE-0-2026-123801)
Vulnerability from cvelistv5 – Published: 2026-11-09 18:18 – Updated: 2026-11-09 18:18
VLAI
EPSS
VEX
Title
SuperTokens Core: SAML callback accepts a replayed RelayState + SAMLResponse, minting a fresh authorization code on each replay
Summary
SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseTo. In the SP-initiated flow, an attacker who obtains a legitimately issued, still-valid SAML response and its matching RelayState can resubmit the pair to /recipe/saml/callback before the assertion's NotOnOrAfter time; in the IdP-initiated flow, the assertion can be replayed without RelayState. The missing Response.InResponseTo check also permits an in-progress login to be completed with an assertion for a different identity and fails to enforce allowIDPInitiatedLogin=false. The callback does not validate Destination or SubjectConfirmationData Recipient and NotOnOrAfter, and each accepted callback mints a fresh, independently redeemable authorization code carrying the captured user's identity. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Severity
7.4 (High)
CWE
Assigner
GitHub_M
CNA
References
13 references
| URL | Tags |
|---|---|
| https://github.com/supertokens/supertokens-core/s… | x_refsource_CONFIRM |
| https://github.com/supertokens/supertokens-core/c… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/c… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/c… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/c… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/c… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/c… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/r… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/r… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/r… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/r… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/r… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/r… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| supertokens | supertokens-core |
Affected:
>= 11.3.0, < 11.3.8
Affected: >= 11.4.0, < 11.4.8 Affected: >= 12.0.0, < 12.0.11 Affected: >= 12.1.0, < 12.1.2 Affected: >= 12.2.0, < 12.2.1 Affected: >= 12.3.0, < 12.3.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "supertokens-core",
"vendor": "supertokens",
"versions": [
{
"status": "affected",
"version": "\u003e= 11.3.0, \u003c 11.3.8"
},
{
"status": "affected",
"version": "\u003e= 11.4.0, \u003c 11.4.8"
},
{
"status": "affected",
"version": "\u003e= 12.0.0, \u003c 12.0.11"
},
{
"status": "affected",
"version": "\u003e= 12.1.0, \u003c 12.1.2"
},
{
"status": "affected",
"version": "\u003e= 12.2.0, \u003c 12.2.1"
},
{
"status": "affected",
"version": "\u003e= 12.3.0, \u003c 12.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseTo. In the SP-initiated flow, an attacker who obtains a legitimately issued, still-valid SAML response and its matching RelayState can resubmit the pair to /recipe/saml/callback before the assertion\u0027s NotOnOrAfter time; in the IdP-initiated flow, the assertion can be replayed without RelayState. The missing Response.InResponseTo check also permits an in-progress login to be completed with an assertion for a different identity and fails to enforce allowIDPInitiatedLogin=false. The callback does not validate Destination or SubjectConfirmationData Recipient and NotOnOrAfter, and each accepted callback mints a fresh, independently redeemable authorization code carrying the captured user\u0027s identity. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-294",
"description": "CWE-294: Authentication Bypass by Capture-replay",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-384",
"description": "CWE-384: Session Fixation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T18:18:47.322Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-3r7x-rhvc-fw28",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-3r7x-rhvc-fw28"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/075655222f5e72f3683a127e45c83c4174fbd4f7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/075655222f5e72f3683a127e45c83c4174fbd4f7"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/4e05d8cf60287e9d2720140031a8b8f4430d056f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/4e05d8cf60287e9d2720140031a8b8f4430d056f"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/557835406547d269f5d0e33159630a1873461c38",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/557835406547d269f5d0e33159630a1873461c38"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/5c42f02e98f67174c6a5a800dd9f8bd5b6e98486",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/5c42f02e98f67174c6a5a800dd9f8bd5b6e98486"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/b6730e608b2d4562939cd4f41ea07df5f841dfe5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/b6730e608b2d4562939cd4f41ea07df5f841dfe5"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/ca2bca9bc900c2fd399d508818ad026cc977dcf6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/ca2bca9bc900c2fd399d508818ad026cc977dcf6"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1"
}
],
"source": {
"advisory": "GHSA-3r7x-rhvc-fw28",
"discovery": "UNKNOWN"
},
"title": "SuperTokens Core: SAML callback accepts a replayed RelayState + SAMLResponse, minting a fresh authorization code on each replay"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-123801",
"datePublished": "2026-11-09T18:18:47.322Z",
"dateReserved": "2026-11-06T15:27:56.226Z",
"dateUpdated": "2026-11-09T18:18:47.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123800 (GCVE-0-2026-123800)
Vulnerability from cvelistv5 – Published: 2026-11-09 18:16 – Updated: 2026-11-09 18:16
VLAI
EPSS
VEX
Title
SuperTokens Core: App-scoped API key can overwrite the parent connection URI domain's credentials and take over sibling applications
Summary
SuperTokens Core is an open source authentication server. From 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, Multitenancy.checkPermissionsForCreateOrUpdate in src/main/java/io/supertokens/multitenancy/Multitenancy.java does not adequately authorize updates to a parent connection URI domain or the base tenant. In a licensed multi-tenant deployment with multiple applications under one non-default connection URI domain and separate api_keys, an attacker holding one application's valid API key can update the parent domain because the CUD-target branch checks the domain without requiring the source application and tenant to be public. Because api_keys is not protected, the attacker can replace the parent key and then sibling application keys, read or modify sibling users, obtain sessions as those users, establish persistence through a sibling dashboard user, and lock out the sibling application's own key. In the advisory's v2 create or update handlers, omitting the optional identifier produces a base-tenant target that skips the permission branches and enterprise-feature gate, allowing changes to firstFactors, required secondary factors, and recipe-enabled flags that affect login integrity and availability. The base-target variant still rejects coreConfig and does not establish key theft. This issue is fixed in versions 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Severity
9.9 (Critical)
Assigner
GitHub_M
CNA
References
37 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| supertokens | supertokens-core |
Affected:
>= 6.0.0, < 6.0.24
Affected: >= 7.0.0, < 7.0.23 Affected: >= 8.0.0, < 8.0.7 Affected: >= 9.0.0, < 9.0.6 Affected: >= 9.1.0, < 9.1.6 Affected: >= 9.2.0, < 9.2.7 Affected: >= 9.3.0, < 9.3.5 Affected: >= 10.0.0, < 10.0.8 Affected: >= 10.1.0, < 10.1.9 Affected: >= 11.0.0, < 11.0.9 Affected: >= 11.1.0, < 11.1.4 Affected: >= 11.2.0, < 11.2.4 Affected: >= 11.3.0, < 11.3.8 Affected: >= 11.4.0, < 11.4.8 Affected: >= 12.0.0, < 12.0.11 Affected: >= 12.1.0, < 12.1.2 Affected: >= 12.2.0, < 12.2.1 Affected: >= 12.3.0, < 12.3.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "supertokens-core",
"vendor": "supertokens",
"versions": [
{
"status": "affected",
"version": "\u003e= 6.0.0, \u003c 6.0.24"
},
{
"status": "affected",
"version": "\u003e= 7.0.0, \u003c 7.0.23"
},
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.7"
},
{
"status": "affected",
"version": "\u003e= 9.0.0, \u003c 9.0.6"
},
{
"status": "affected",
"version": "\u003e= 9.1.0, \u003c 9.1.6"
},
{
"status": "affected",
"version": "\u003e= 9.2.0, \u003c 9.2.7"
},
{
"status": "affected",
"version": "\u003e= 9.3.0, \u003c 9.3.5"
},
{
"status": "affected",
"version": "\u003e= 10.0.0, \u003c 10.0.8"
},
{
"status": "affected",
"version": "\u003e= 10.1.0, \u003c 10.1.9"
},
{
"status": "affected",
"version": "\u003e= 11.0.0, \u003c 11.0.9"
},
{
"status": "affected",
"version": "\u003e= 11.1.0, \u003c 11.1.4"
},
{
"status": "affected",
"version": "\u003e= 11.2.0, \u003c 11.2.4"
},
{
"status": "affected",
"version": "\u003e= 11.3.0, \u003c 11.3.8"
},
{
"status": "affected",
"version": "\u003e= 11.4.0, \u003c 11.4.8"
},
{
"status": "affected",
"version": "\u003e= 12.0.0, \u003c 12.0.11"
},
{
"status": "affected",
"version": "\u003e= 12.1.0, \u003c 12.1.2"
},
{
"status": "affected",
"version": "\u003e= 12.2.0, \u003c 12.2.1"
},
{
"status": "affected",
"version": "\u003e= 12.3.0, \u003c 12.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SuperTokens Core is an open source authentication server. From 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, Multitenancy.checkPermissionsForCreateOrUpdate in src/main/java/io/supertokens/multitenancy/Multitenancy.java does not adequately authorize updates to a parent connection URI domain or the base tenant. In a licensed multi-tenant deployment with multiple applications under one non-default connection URI domain and separate api_keys, an attacker holding one application\u0027s valid API key can update the parent domain because the CUD-target branch checks the domain without requiring the source application and tenant to be public. Because api_keys is not protected, the attacker can replace the parent key and then sibling application keys, read or modify sibling users, obtain sessions as those users, establish persistence through a sibling dashboard user, and lock out the sibling application\u0027s own key. In the advisory\u0027s v2 create or update handlers, omitting the optional identifier produces a base-tenant target that skips the permission branches and enterprise-feature gate, allowing changes to firstFactors, required secondary factors, and recipe-enabled flags that affect login integrity and availability. The base-target variant still rejects coreConfig and does not establish key theft. This issue is fixed in versions 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T18:16:08.303Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-4rf2-xqvf-8rcx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-4rf2-xqvf-8rcx"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/13c3de170dd40dd217db0f6bd2bded0948476a42",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/13c3de170dd40dd217db0f6bd2bded0948476a42"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/1cc02b971f064c2fa2d9bc74b9e85795fdc6a7e5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/1cc02b971f064c2fa2d9bc74b9e85795fdc6a7e5"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/1d9dcb03ce0691d9b8abee48f86cc2729a6008cb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/1d9dcb03ce0691d9b8abee48f86cc2729a6008cb"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/337bb3eba812a5ee52d57854701820a0580b6050",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/337bb3eba812a5ee52d57854701820a0580b6050"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/4902b713f31306ca41148070d10b6185f0e85201",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/4902b713f31306ca41148070d10b6185f0e85201"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/4d1ef0e177681f4f74995e4a25a17d224effe115",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/4d1ef0e177681f4f74995e4a25a17d224effe115"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/61bfd3ebde1cf4b092da85ee884fa15e288aad51",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/61bfd3ebde1cf4b092da85ee884fa15e288aad51"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/64dfa92c50a2ec288fe787ee5c2fad45548a6475",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/64dfa92c50a2ec288fe787ee5c2fad45548a6475"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/8db9b0c39f97f240e116821434d4eb3c907faccf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/8db9b0c39f97f240e116821434d4eb3c907faccf"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/8e48ef856becbaaeb50ad4c915be1d7ce279416b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/8e48ef856becbaaeb50ad4c915be1d7ce279416b"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/9b0d3a9fdbdcb48dd7dd9d520075bbefbae3cf9b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/9b0d3a9fdbdcb48dd7dd9d520075bbefbae3cf9b"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/a186f1013c784de8a796a732e925e1870fec0f40",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/a186f1013c784de8a796a732e925e1870fec0f40"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/b58bc3d03549d20495df71c03ef5478799c184db",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/b58bc3d03549d20495df71c03ef5478799c184db"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/bf6184f027a99bd1b3b1df3d20e376dda6521399",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/bf6184f027a99bd1b3b1df3d20e376dda6521399"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/c6d7dc7d73b9bb3075b3f7a1a0c0c5780430c292",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/c6d7dc7d73b9bb3075b3f7a1a0c0c5780430c292"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/df79f3b4399ef31aea4cb44cc7b65761a2cb94a7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/df79f3b4399ef31aea4cb44cc7b65761a2cb94a7"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/e616f4002c31d256f9ff6cb3d3685b924ef53a6d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/e616f4002c31d256f9ff6cb3d3685b924ef53a6d"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/ff9ca3ec53861a91996c4e9581fa6f2e01331736",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/ff9ca3ec53861a91996c4e9581fa6f2e01331736"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v10.0.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v10.0.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v10.1.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v10.1.9"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v6.0.24",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v6.0.24"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v7.0.23",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v7.0.23"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v8.0.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v8.0.7"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v9.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v9.0.6"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v9.1.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v9.1.6"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v9.2.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v9.2.7"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v9.3.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v9.3.5"
}
],
"source": {
"advisory": "GHSA-4rf2-xqvf-8rcx",
"discovery": "UNKNOWN"
},
"title": "SuperTokens Core: App-scoped API key can overwrite the parent connection URI domain\u0027s credentials and take over sibling applications"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-123800",
"datePublished": "2026-11-09T18:16:08.303Z",
"dateReserved": "2026-11-06T15:27:56.225Z",
"dateUpdated": "2026-11-09T18:16:08.303Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123799 (GCVE-0-2026-123799)
Vulnerability from cvelistv5 – Published: 2026-11-09 18:07 – Updated: 2026-11-09 22:58
VLAI
EPSS
VEX
Title
SuperTokens Core: Dashboard session tokens are never checked for expiry: `isValidUserSession` ignores the stored `expiry`, so a long-expired admin session still authenticates
Summary
SuperTokens Core is an open source authentication server. From 11.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, and 12.1.2, Dashboard.isValidUserSession treats any stored session row as valid without comparing DashboardSessionInfo.expiry to the current time. DashboardQueries.getSessionInfoWithSessionId also selects by app and session identifier without an expiry predicate, leaving the periodic DeleteExpiredDashboardSessions cleanup as the only expiration enforcement. An attacker who obtains a dashboard administrator session after its 30-day lifetime can continue using POST /recipe/dashboard/session/verify until the row is removed, and frequent Core restarts can prevent the 12-hour cleanup sweep from running. The stale session retains full dashboard read and write access, but the flaw does not provide a way to guess or acquire the random session identifier. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, and 12.1.2.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 22:58 UTC
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
GitHub_M
CNA
References
17 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| supertokens | supertokens-core |
Affected:
>= 11.0.0, < 11.0.9
Affected: >= 11.1.0, < 11.1.4 Affected: >= 11.2.0, < 11.2.4 Affected: >= 11.3.0, < 11.3.8 Affected: >= 11.4.0, < 11.4.8 Affected: >= 12.0.0, < 12.0.11 Affected: >= 12.1.0, < 12.1.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123799",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T22:58:04.469475Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:58:19.719Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "supertokens-core",
"vendor": "supertokens",
"versions": [
{
"status": "affected",
"version": "\u003e= 11.0.0, \u003c 11.0.9"
},
{
"status": "affected",
"version": "\u003e= 11.1.0, \u003c 11.1.4"
},
{
"status": "affected",
"version": "\u003e= 11.2.0, \u003c 11.2.4"
},
{
"status": "affected",
"version": "\u003e= 11.3.0, \u003c 11.3.8"
},
{
"status": "affected",
"version": "\u003e= 11.4.0, \u003c 11.4.8"
},
{
"status": "affected",
"version": "\u003e= 12.0.0, \u003c 12.0.11"
},
{
"status": "affected",
"version": "\u003e= 12.1.0, \u003c 12.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SuperTokens Core is an open source authentication server. From 11.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, and 12.1.2, Dashboard.isValidUserSession treats any stored session row as valid without comparing DashboardSessionInfo.expiry to the current time. DashboardQueries.getSessionInfoWithSessionId also selects by app and session identifier without an expiry predicate, leaving the periodic DeleteExpiredDashboardSessions cleanup as the only expiration enforcement. An attacker who obtains a dashboard administrator session after its 30-day lifetime can continue using POST /recipe/dashboard/session/verify until the row is removed, and frequent Core restarts can prevent the 12-hour cleanup sweep from running. The stale session retains full dashboard read and write access, but the flaw does not provide a way to guess or acquire the random session identifier. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, and 12.1.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613: Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T18:07:37.939Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-w9fp-wv6g-pqv8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-w9fp-wv6g-pqv8"
},
{
"name": "https://github.com/supertokens/supertokens-core/pull/1409",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/pull/1409"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/0f4817152278b39fbf21b97c3795b4fc68c12c38",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/0f4817152278b39fbf21b97c3795b4fc68c12c38"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/4b315b2382c8eec2cde28fbda113597bffad8da5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/4b315b2382c8eec2cde28fbda113597bffad8da5"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/699d806b5fc77ee6343f8e48e0769dce8049b078",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/699d806b5fc77ee6343f8e48e0769dce8049b078"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/8906b840669b28b3af7367cf18870db0044d0d18",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/8906b840669b28b3af7367cf18870db0044d0d18"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/bd8eb93001cf814a8065e8f3cea755af267bc308",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/bd8eb93001cf814a8065e8f3cea755af267bc308"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/ced1c913d53641e5eb8108caef110e55348b5401",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/ced1c913d53641e5eb8108caef110e55348b5401"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/da0ec91d20ecbb68730741f8b0dec8c986b68877",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/da0ec91d20ecbb68730741f8b0dec8c986b68877"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/e72793ec5bd925fd3b9ff19328043dc2a03201bd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/e72793ec5bd925fd3b9ff19328043dc2a03201bd"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2"
}
],
"source": {
"advisory": "GHSA-w9fp-wv6g-pqv8",
"discovery": "UNKNOWN"
},
"title": "SuperTokens Core: Dashboard session tokens are never checked for expiry: `isValidUserSession` ignores the stored `expiry`, so a long-expired admin session still authenticates"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-123799",
"datePublished": "2026-11-09T18:07:37.939Z",
"dateReserved": "2026-11-06T15:27:56.225Z",
"dateUpdated": "2026-11-09T22:58:19.719Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123798 (GCVE-0-2026-123798)
Vulnerability from cvelistv5 – Published: 2026-11-09 18:04 – Updated: 2026-11-09 18:04
VLAI
EPSS
VEX
Title
SuperTokens Core: SAML XML Signature Wrapping authentication bypass — any IdP user can authenticate as any other user
Summary
SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.7, 11.4.7, and 12.0.10, SAML.verifySamlResponseSignature calls OpenSAML SignatureValidator.validate without first applying SAMLSignatureProfileValidator. The Core can therefore accept a cryptographically valid signature that references a different XML element from the Response or Assertion whose NameID and attributes are used for authentication. An ordinary user of the configured identity provider can move a genuinely signed element elsewhere in the document while supplying an attacker-authored identity-bearing element, causing XML Signature Wrapping authentication as another IdP user. Both response-level and assertion-level signing paths are affected, and SP-initiated login remains reachable without enabling allowIDPInitiatedLogin. This issue is fixed in versions 11.3.7, 11.4.7, and 12.0.10.
Severity
8.1 (High)
Assigner
GitHub_M
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/supertokens/supertokens-core/s… | x_refsource_CONFIRM |
| https://github.com/supertokens/supertokens-core/c… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/c… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/c… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/r… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/r… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/r… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| supertokens | supertokens-core |
Affected:
>= 12.0.6, < 12.0.10
Affected: >= 11.4.0, < 11.4.7 Affected: >= 11.3.0, < 11.3.7 |
{
"containers": {
"cna": {
"affected": [
{
"product": "supertokens-core",
"vendor": "supertokens",
"versions": [
{
"status": "affected",
"version": "\u003e= 12.0.6, \u003c 12.0.10"
},
{
"status": "affected",
"version": "\u003e= 11.4.0, \u003c 11.4.7"
},
{
"status": "affected",
"version": "\u003e= 11.3.0, \u003c 11.3.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.7, 11.4.7, and 12.0.10, SAML.verifySamlResponseSignature calls OpenSAML SignatureValidator.validate without first applying SAMLSignatureProfileValidator. The Core can therefore accept a cryptographically valid signature that references a different XML element from the Response or Assertion whose NameID and attributes are used for authentication. An ordinary user of the configured identity provider can move a genuinely signed element elsewhere in the document while supplying an attacker-authored identity-bearing element, causing XML Signature Wrapping authentication as another IdP user. Both response-level and assertion-level signing paths are affected, and SP-initiated login remains reachable without enabling allowIDPInitiatedLogin. This issue is fixed in versions 11.3.7, 11.4.7, and 12.0.10."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T18:04:20.419Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-gvx2-mwmj-wwvj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-gvx2-mwmj-wwvj"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/8d06b0cfb5409c5bf505051ddfcb94d66367caae",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/8d06b0cfb5409c5bf505051ddfcb94d66367caae"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/9cba541ae2ed87b878d11b257bc9b8b78341f50a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/9cba541ae2ed87b878d11b257bc9b8b78341f50a"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/d0773f2a6497411aeda5d4f03d3d135a2a3ae79c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/d0773f2a6497411aeda5d4f03d3d135a2a3ae79c"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.7"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.7"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.10",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.10"
}
],
"source": {
"advisory": "GHSA-gvx2-mwmj-wwvj",
"discovery": "UNKNOWN"
},
"title": "SuperTokens Core: SAML XML Signature Wrapping authentication bypass \u2014 any IdP user can authenticate as any other user"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-123798",
"datePublished": "2026-11-09T18:04:20.419Z",
"dateReserved": "2026-11-06T15:27:56.225Z",
"dateUpdated": "2026-11-09T18:04:20.419Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123797 (GCVE-0-2026-123797)
Vulnerability from cvelistv5 – Published: 2026-11-09 17:52 – Updated: 2026-11-09 17:59
VLAI
EPSS
VEX
Title
SuperTokens Core: Unknown tenant path bypasses API key and public-tenant enforcement
Summary
SuperTokens Core is an open source authentication server. Prior to 11.3.6, 11.4.6, and 12.0.8, app-specific management requests using an unknown tenant path and an older supported cdi-version can bypass API-key and public-tenant enforcement. In src/main/java/io/supertokens/webserver/WebserverAPI.java, checkIPAccess and assertThatAPIKeyCheckPasses suppress TenantOrAppNotFoundException, while the later app-specific handler resolves app/public storage and the public-tenant guard applies only to CDI versions 5.0 and later. An unauthenticated caller able to reach the Core endpoint can therefore use PUT /ghosttenant/recipe/role and GET /ghosttenant/recipe/roles to create and enumerate application roles without a valid API key. This issue is fixed in versions 11.3.6, 11.4.6, and 12.0.8.
Severity
7.5 (High)
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
GitHub_M
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/supertokens/supertokens-core/s… | x_refsource_CONFIRM |
| https://github.com/supertokens/supertokens-core/c… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/c… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/c… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/r… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/r… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/r… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| supertokens | supertokens-core |
Affected:
< 11.3.6
Affected: >= 11.4.0, < 11.4.6 Affected: >= 12.0.6, < 12.0.8 |
{
"containers": {
"cna": {
"affected": [
{
"product": "supertokens-core",
"vendor": "supertokens",
"versions": [
{
"status": "affected",
"version": "\u003c 11.3.6"
},
{
"status": "affected",
"version": "\u003e= 11.4.0, \u003c 11.4.6"
},
{
"status": "affected",
"version": "\u003e= 12.0.6, \u003c 12.0.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SuperTokens Core is an open source authentication server. Prior to 11.3.6, 11.4.6, and 12.0.8, app-specific management requests using an unknown tenant path and an older supported cdi-version can bypass API-key and public-tenant enforcement. In src/main/java/io/supertokens/webserver/WebserverAPI.java, checkIPAccess and assertThatAPIKeyCheckPasses suppress TenantOrAppNotFoundException, while the later app-specific handler resolves app/public storage and the public-tenant guard applies only to CDI versions 5.0 and later. An unauthenticated caller able to reach the Core endpoint can therefore use PUT /ghosttenant/recipe/role and GET /ghosttenant/recipe/roles to create and enumerate application roles without a valid API key. This issue is fixed in versions 11.3.6, 11.4.6, and 12.0.8."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:59:25.028Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-q7mc-f2jm-r4gr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-q7mc-f2jm-r4gr"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/1bad648d7b77aca058cb6bf75373455bacc4e537",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/1bad648d7b77aca058cb6bf75373455bacc4e537"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/5811a10190b1d4d8d7a9fe2e17cb49437e6ffa49",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/5811a10190b1d4d8d7a9fe2e17cb49437e6ffa49"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/7ce22db2b6ba95d7666adc51bb9ee60ac7d3d198",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/7ce22db2b6ba95d7666adc51bb9ee60ac7d3d198"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.6"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.6"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.8"
}
],
"source": {
"advisory": "GHSA-q7mc-f2jm-r4gr",
"discovery": "UNKNOWN"
},
"title": "SuperTokens Core: Unknown tenant path bypasses API key and public-tenant enforcement"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-123797",
"datePublished": "2026-11-09T17:52:54.576Z",
"dateReserved": "2026-11-06T15:27:56.225Z",
"dateUpdated": "2026-11-09T17:59:25.028Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}