CVE-2026-123804mediumCWE-362CWE-613

CVE-2026-123804: falha de média gravidade em supertokens-core

SuperTokens Core: A session created concurrently with account unlink survives the unlink

Publicada em

Seguir esta CVE+ Monitorar supertokens-core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.8epss 0.4%
SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated and revoked the existing sessions. A user who controls the linked login method can exploit this race to retain a signed, database-backed, refreshable session as the former primary identity after that method is unlinked; the session persists until expiry or explicit revocation. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
supertokens · supertokens-core
CVEs relacionadas — supertokens-core

No mesmo produto, das mais perigosas para as menos.

CVE-2026-123799HIGHSuperTokens Core: Dashboard session tokens are never checked for expiry: `isValidUserSession` ignores the stored `expiry`, so a long-expired admin session still authenticatesEPSS 0.8%CVE-2026-123800CRITICALSuperTokens Core: App-scoped API key can overwrite the parent connection URI domain's credentials and take over sibling applicationsEPSS 0.6%CVE-2026-123803HIGHSuperTokens Core: WebAuthn sign-in accepts a passkey across tenant boundariesEPSS 0.5%CVE-2026-123797HIGHSuperTokens Core: Unknown tenant path bypasses API key and public-tenant enforcementEPSS 0.5%CVE-2026-123801HIGHSuperTokens Core: SAML callback accepts a replayed RelayState + SAMLResponse, minting a fresh authorization code on each replayEPSS 0.4%CVE-2026-123802HIGHSuperTokens Core SAML: identity taken from an assertion that never passed the audience check, allowing sign-in as any IdP userEPSS 0.3%