SuperTokens Core is an open source authentication server.
CVE-2026-123800
SuperTokens Core is an open source authentication server. From 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, Multitenancy.checkPermissionsForCreateOrUpdate in src/main/java/io/supertokens/multitenancy/Multitenancy.java does not adequately authorize updates to a parent connection URI domain or the base tenant. In a licensed multi-tenant deployment with multiple applications under one non-default connection URI domain and separate apikeys, an attacker holding one application's valid API key can update the parent domain because the CUD-target branch checks the domain without requiring the source application and tenant to be public. Because apikeys is not protected, the attacker can replace the parent key and then sibling application keys, read or modify sibling users, obtain sessions as those users, establish persistence through a sibling dashboard user, and lock out the sibling application's own key. In the advisory's v2 create or update handlers, omitting the optional identifier produces a base-tenant target that skips the permission branches and enterprise-feature gate,…
Assessment
- CVSS
- 9.9 (v3.1)
- Severity
- Critical
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 9 November 2026
- Last updated
- 9 November 2026
- Affected
- supertokens · supertokens-core
- Assigner
- GitHub_M
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
At the source
References
- https://github.com/supertokens/supertokens-core/security/advisories/GHSA-4rf2-xqvf-8rcx
- https://github.com/supertokens/supertokens-core/commit/13c3de170dd40dd217db0f6bd2bded0948476a42
- https://github.com/supertokens/supertokens-core/commit/1cc02b971f064c2fa2d9bc74b9e85795fdc6a7e5
- https://github.com/supertokens/supertokens-core/commit/1d9dcb03ce0691d9b8abee48f86cc2729a6008cb
- https://github.com/supertokens/supertokens-core/commit/337bb3eba812a5ee52d57854701820a0580b6050
- https://github.com/supertokens/supertokens-core/commit/4902b713f31306ca41148070d10b6185f0e85201
- https://github.com/supertokens/supertokens-core/commit/4d1ef0e177681f4f74995e4a25a17d224effe115
- https://github.com/supertokens/supertokens-core/commit/61bfd3ebde1cf4b092da85ee884fa15e288aad51
- https://github.com/supertokens/supertokens-core/commit/64dfa92c50a2ec288fe787ee5c2fad45548a6475
- https://github.com/supertokens/supertokens-core/commit/8db9b0c39f97f240e116821434d4eb3c907faccf
- https://github.com/supertokens/supertokens-core/commit/8e48ef856becbaaeb50ad4c915be1d7ce279416b
- https://github.com/supertokens/supertokens-core/commit/9b0d3a9fdbdcb48dd7dd9d520075bbefbae3cf9b
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-123800