SuperTokens Core: Dashboard session expiry validation bypass (CVE-2026-123799)
SuperTokens Core fails to validate dashboard session expiry at the API level, relying instead on a periodic cleanup task.
CVE search metadata
CVE search record: CVE-2026-123799. Severity: high. CVSS: 7.4. KEV: no. Product: SuperTokens Core (11.0.0-11.0.8). Brief: SuperTokens Core: Dashboard session expiry validation bypass (CVE-2026-123799). Brief link: https://feed.craftedsignal.io/briefs/2026-11-supertokens-core-session-validation/
Triage facts
Revision 1- Applicability
- SuperTokens Core (11.0.0-11.0.8)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 21:59 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
SuperTokens Core versions 11.0.0 through 11.0.8, 11.1.0 through 11.1.3, 11.2.0 through 11.2.3, 11.3.0 through 11.3.7, 11.4.0 through 11.4.7, 12.0.0 through 12.0.10, and 12.1.0 through 12.1.1 contain a vulnerability where Dashboard.isValidUserSession and DashboardQueries.getSessionInfoWithSessionId do not compare DashboardSessionInfo.expiry to the current time.
Impact
The system relies on the DeleteExpiredDashboardSessions task for expiration enforcement. An attacker who has obtained a dashboard administrator session can continue to use it via POST /recipe/dashboard/session/verify until the row is removed. Frequent Core restarts may prevent the 12-hour cleanup sweep, extending the window of access. The flaw does not allow for guessing or acquiring the random session identifier.