SuperTokens Core: Authorization bypass in Multitenancy module (CVE-2026-123800)

SuperTokens Core, an open-source authentication server, is affected by an authorization bypass vulnerability (CVE-2026-123800) in the Multitenancy.checkPermissionsForCreateOrUpdate function. The vulnerability stems from inadequate authorization checks when processing updates to parent connection URI domains or the base tenant configuration. In multi-tenant deployments, an attacker possessing a valid API key for one application can exploit this logic flaw to modify the parent domain configuration, potentially impacting sibling applications.

Impact

Successful exploitation allows unauthorized cross-tenant modifications. Observed impacts include the replacement of API keys, modification of sibling application user data, session hijacking, lockout of legitimate application administrators, and establishment of persistence via unauthorized dashboard user accounts. Additionally, manipulation of the base tenant target allows an attacker to alter authentication factors (firstFactors) and recipe-enabled flags, impacting service availability and login integrity.

Recommendation

1. Upgrade SuperTokens Core to the fixed versions (6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, or 12.3.1).
2. Audit current multi-tenant configurations for unauthorized modifications to api_keys or authentication factor settings within the SuperTokens Core backend logs.
3. Restrict administrative access to the multitenancy API endpoints.