HIGH 8.1 NVD
CVE-2026-123803
SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOpt
SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform application-scoped WebAuthn lookups without constraining them to the requested tenant, and WebAuthN.signIn does not verify tenant membership. In a multi-tenant deployment using WebAuthn with a shared user pool, an ordinary user who possesses their own valid passkey in one tenant can submit its assertion to another tenant's sign-in endpoint in the same application and be authenticated there despite having no membership in the target tenant. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
References
- https://github.com/supertokens/supertokens-core/commit/01ca34a06baa0d22db008f38c8eabd1f669
- https://github.com/supertokens/supertokens-core/commit/030643edea5d69e0009ceeecbc5dd70be5c
- https://github.com/supertokens/supertokens-core/commit/1e3e4d9b25237a9c8fd77cbe0d4d0ecb360
- https://github.com/supertokens/supertokens-core/commit/84492e38f9eb6db0cc338674ce5e94d1603
- https://github.com/supertokens/supertokens-core/commit/982d420a5ac29d5e362eaf39169a7a9f533
This high severity vulnerability with a CVSS score of 8.1 was published on 2026-11-09 via NVD.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.