Skip to content
Threat Feed
Subscribe
high advisory

SuperTokens Core: Authentication bypass via API-key and tenant enforcement (CVE-2026-123797)

SuperTokens Core versions prior to 11.3.6, 11.4.6, and 12.0.8 are vulnerable to an authentication bypass that allows unauthenticated role management due to improper handling of tenant paths and CDI versions.

CVE search metadata

CVE search record: CVE-2026-123797. Severity: high. CVSS: 7.5. KEV: no. Product: SuperTokens Core (< 11.3.6, 11.4.6, 12.0.8). Brief: SuperTokens Core: Authentication bypass via API-key and tenant enforcement (CVE-2026-123797). Brief link: https://feed.craftedsignal.io/briefs/2026-11-supertokens-auth-bypass/

Triage facts

Revision 1
Applicability
SuperTokens Core (< 11.3.6, 11.4.6, 12.0.8)
Evidence
Unknown
Severity
High
Action
Immediate escalation
Sources
1 public source
Freshness
Revision 1Nov 9, 19:57 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

SuperTokens Core contains an authentication bypass vulnerability (CVE-2026-123797) affecting versions prior to 11.3.6, 11.4.6, and 12.0.8. An unauthenticated attacker capable of reaching the Core endpoint can use unknown tenant paths combined with older supported CDI versions to bypass API-key and public-tenant enforcement. This occurs because the checkIPAccess and assertThatAPIKeyCheckPasses functions suppress TenantOrAppNotFoundException, and the public-tenant guard only applies to CDI versions 5.0 and later.

Impact

Successful exploitation allows an unauthenticated attacker to create and enumerate application roles by sending crafted requests to the Core API, such as PUT /ghosttenant/recipe/role and GET /ghosttenant/recipe/roles.

Recommendation

  • Patch SuperTokens Core by upgrading to versions 11.3.6, 11.4.6, or 12.0.8 immediately.
  • Audit access logs for requests involving /ghosttenant/ or unconventional tenant paths targeting role management endpoints.
  • Restrict network access to the SuperTokens Core API endpoint to trusted infrastructure only.

Immediate actions

Upgrade SuperTokens Core to 11.3.6, 11.4.6, or 12.0.8

IT Operations 24h

Threat Hunt

Search web access logs for /ghosttenant/ URIs

T1190 high high confidence hunt now

Data: Web server URI access logs

Mitigations

Upgrade SuperTokens Core to 11.3.6 or later

immediate IT Operations

CVE-2026-123797

Detection coverage 1

Detect Potential CVE-2026-123797 Exploitation - Role Management Bypass

high

Detects requests to the SuperTokens Core API involving the /ghosttenant/ path, which is associated with CVE-2026-123797 authentication bypass.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →