SuperTokens Core: XML Signature Wrapping vulnerability (CVE-2026-123798)
SuperTokens Core is vulnerable to XML Signature Wrapping (XSW) due to improper validation of SAML signatures, allowing authenticated users to impersonate other accounts.
CVE search metadata
CVE search record: CVE-2026-123798. Severity: high. CVSS: 8.1. KEV: no. Product: SuperTokens Core (>= 11.3.0, < 11.3.7; >= 11.4.0, < 11.4.7; >= 12.0.0, < 12.0.10). Brief: SuperTokens Core: XML Signature Wrapping vulnerability (CVE-2026-123798). Brief link: https://feed.craftedsignal.io/briefs/2026-11-supertokens-xsw/
Triage facts
Revision 1- Applicability
- SuperTokens Core (>= 11.3.0, < 11.3.7; >= 11.4.0, < 11.4.7; >= 12.0.0, < 12.0.10)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 10, 18:28 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
SuperTokens Core (versions >= 11.3.0, < 11.3.7; >= 11.4.0, < 11.4.7; >= 12.0.0, < 12.0.10) contains an XML Signature Wrapping (XSW) vulnerability. The application fails to apply the necessary SAMLSignatureProfileValidator before calling OpenSAML for signature verification. This allows an attacker to manipulate a SAML response by moving a valid signature to an attacker-controlled identity element, leading to successful impersonation of other identity provider users. The issue impacts both response-level and assertion-level signing paths.
Impact
Successful exploitation allows an authenticated user to perform authentication bypass and assume the identity of another user within the system.
Recommendation
- Upgrade SuperTokens Core to version 11.3.7, 11.4.7, 12.0.10, or later.
- Review authentication logs for anomalous account access patterns or rapid account switching by the same user session.
- Evaluate the necessity of SAML configurations that allow user-provided XML signatures if specific patching is delayed.
Immediate actions
Upgrade SuperTokens Core to 11.3.7, 11.4.7, or 12.0.10
Threat Hunt
Analyze SAML authentication logs for malformed or unexpectedly large XML assertions
Data: SAML response XML blobs, Authentication service logs
Mitigations
Apply software update to affected instances
CVE-2026-123798