🔐 CVE Alert

CVE-2026-123803

HIGH 8.1

SuperTokens Core: WebAuthn sign-in accepts a passkey across tenant boundaries

CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th

SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform application-scoped WebAuthn lookups without constraining them to the requested tenant, and WebAuthN.signIn does not verify tenant membership. In a multi-tenant deployment using WebAuthn with a shared user pool, an ordinary user who possesses their own valid passkey in one tenant can submit its assertion to another tenant's sign-in endpoint in the same application and be authenticated there despite having no membership in the target tenant. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.

CWE CWE-863 CWE-1220
Vendor supertokens
Product supertokens-core
Published Nov 9, 2026
Stay Ahead of the Next One

Get instant alerts for supertokens supertokens-core

Be the first to know when new high vulnerabilities affecting supertokens supertokens-core are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Affected Versions

supertokens / supertokens-core
>= 10.1.0, < 11.0.0 >= 11.0.0, < 11.0.9 >= 11.1.0, < 11.1.4 >= 11.2.0, < 11.2.4 >= 11.3.0, < 11.3.8 >= 11.4.0, < 11.4.8 >= 12.0.0, < 12.0.11 >= 12.1.0, < 12.1.2 >= 12.2.0, < 12.2.1 >= 12.3.0, < 12.3.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗
github.com: https://github.com/supertokens/supertokens-core/security/advisories/GHSA-6v34-w48w-44rc github.com: https://github.com/supertokens/supertokens-core/commit/01ca34a06baa0d22db008f38c8eabd1f6695d9a6 github.com: https://github.com/supertokens/supertokens-core/commit/030643edea5d69e0009ceeecbc5dd70be5c66186 github.com: https://github.com/supertokens/supertokens-core/commit/1e3e4d9b25237a9c8fd77cbe0d4d0ecb360d8cd6 github.com: https://github.com/supertokens/supertokens-core/commit/84492e38f9eb6db0cc338674ce5e94d1603bef08 github.com: https://github.com/supertokens/supertokens-core/commit/982d420a5ac29d5e362eaf39169a7a9f5339abeb github.com: https://github.com/supertokens/supertokens-core/commit/a3d033022effb00ccf0c4ec6ca77c36eb1a24617 github.com: https://github.com/supertokens/supertokens-core/commit/ad768c1925e245930e5fbf9441452d85564de91d github.com: https://github.com/supertokens/supertokens-core/commit/b933b6c9b4495e47a8b3efeb5a70e9d014777320 github.com: https://github.com/supertokens/supertokens-core/commit/e19d173f47658d036685d3020e18819c5f3690b7 github.com: https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9 github.com: https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4 github.com: https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4 github.com: https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8 github.com: https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11 github.com: https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2 github.com: https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1 github.com: https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1