SuperTokens Core: SAML Authentication Replay Vulnerability (CVE-2026-123801)
SuperTokens Core fails to properly validate SAML assertions, allowing for replay attacks and identity spoofing in specific configurations.
CVE search metadata
CVE search record: CVE-2026-123801. Severity: high. CVSS: 7.4. KEV: no. Product: SuperTokens Core (11.3.0-11.3.7). Brief: SuperTokens Core: SAML Authentication Replay Vulnerability (CVE-2026-123801). Brief link: https://feed.craftedsignal.io/briefs/2026-11-supertokens-saml-replay/
Triage facts
Revision 1- Applicability
- SuperTokens Core (11.3.0-11.3.7)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 10, 20:36 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
SuperTokens Core versions 11.3.0 through 11.3.7, 11.4.0 through 11.4.7, 12.0.0 through 12.0.10, 12.1.0 through 12.1.1, 12.2.0, and 12.3.0 are vulnerable to SAML assertion replay and identity spoofing. The SAML.handleCallback function does not consume RelayState, record assertion identifiers, or enforce Response.InResponseTo.
In SP-initiated flows, attackers can resubmit valid SAML responses to /recipe/saml/callback before the NotOnOrAfter time. In IdP-initiated flows, assertions can be replayed without RelayState. Additionally, missing checks for Destination, SubjectConfirmationData Recipient, and NotOnOrAfter allow accepted callbacks to mint new authorization codes. The application also fails to enforce allowIDPInitiatedLogin=false.