CVE-2026-123803highCWE-1220CWE-863

CVE-2026-123803: falha de alta gravidade em supertokens-core

SuperTokens Core: WebAuthn sign-in accepts a passkey across tenant boundaries

Publicada em

Seguir esta CVE+ Monitorar supertokens-core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 0.5%
SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform application-scoped WebAuthn lookups without constraining them to the requested tenant, and WebAuthN.signIn does not verify tenant membership. In a multi-tenant deployment using WebAuthn with a shared user pool, an ordinary user who possesses their own valid passkey in one tenant can submit its assertion to another tenant's sign-in endpoint in the same application and be authenticated there despite having no membership in the target tenant. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
supertokens · supertokens-core
CVEs relacionadas — supertokens-core

No mesmo produto, das mais perigosas para as menos.

CVE-2026-123799HIGHSuperTokens Core: Dashboard session tokens are never checked for expiry: `isValidUserSession` ignores the stored `expiry`, so a long-expired admin session still authenticatesEPSS 0.8%CVE-2026-123800CRITICALSuperTokens Core: App-scoped API key can overwrite the parent connection URI domain's credentials and take over sibling applicationsEPSS 0.6%CVE-2026-123797HIGHSuperTokens Core: Unknown tenant path bypasses API key and public-tenant enforcementEPSS 0.5%CVE-2026-123804MEDIUMSuperTokens Core: A session created concurrently with account unlink survives the unlinkEPSS 0.4%CVE-2026-123801HIGHSuperTokens Core: SAML callback accepts a replayed RelayState + SAMLResponse, minting a fresh authorization code on each replayEPSS 0.4%CVE-2026-123802HIGHSuperTokens Core SAML: identity taken from an assertion that never passed the audience check, allowing sign-in as any IdP userEPSS 0.3%