Vulnerabilidades em supertokens
8 resultadosAnálise Vexday
O fornecedor supertokens possui 8 CVEs na base do Vexday, sendo 1 classificada como crítica pelo CVSS e nenhuma listada no catálogo KEV, o que indica ausência de exploração ativa confirmada. A fraqueza dominante é a CWE-1220, e todas as 8 vulnerabilidades foram publicadas nos últimos 90 dias, o que aponta para um risco recente que merece acompanhamento.
CVE-2026-123799HIGHSuperTokens Core: Dashboard session tokens are never checked for expiry: `isValidUserSession` ignores the stored `expiry`, so a long-expired admin session still authenticatesEPSS 0.8%CVE-2026-123800CRITICALSuperTokens Core: App-scoped API key can overwrite the parent connection URI domain's credentials and take over sibling applicationsEPSS 0.6%CVE-2026-123803HIGHSuperTokens Core: WebAuthn sign-in accepts a passkey across tenant boundariesEPSS 0.5%CVE-2026-123797HIGHSuperTokens Core: Unknown tenant path bypasses API key and public-tenant enforcementEPSS 0.5%CVE-2026-123804MEDIUMSuperTokens Core: A session created concurrently with account unlink survives the unlinkEPSS 0.4%CVE-2026-123801HIGHSuperTokens Core: SAML callback accepts a replayed RelayState + SAMLResponse, minting a fresh authorization code on each replayEPSS 0.4%CVE-2026-123802HIGHSuperTokens Core SAML: identity taken from an assertion that never passed the audience check, allowing sign-in as any IdP userEPSS 0.3%CVE-2026-123798HIGHSuperTokens Core: SAML XML Signature Wrapping authentication bypass — any IdP user can authenticate as any other userEPSS 0.2%