{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3asupertokenscore/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:supertokens:core:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-123799"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SuperTokens Core (11.0.0-11.0.8)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["SuperTokens"],"content_html":"\u003cp\u003eSuperTokens Core versions 11.0.0 through 11.0.8, 11.1.0 through 11.1.3, 11.2.0 through 11.2.3, 11.3.0 through 11.3.7, 11.4.0 through 11.4.7, 12.0.0 through 12.0.10, and 12.1.0 through 12.1.1 contain a vulnerability where \u003ccode\u003eDashboard.isValidUserSession\u003c/code\u003e and \u003ccode\u003eDashboardQueries.getSessionInfoWithSessionId\u003c/code\u003e do not compare \u003ccode\u003eDashboardSessionInfo.expiry\u003c/code\u003e to the current time.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe system relies on the \u003ccode\u003eDeleteExpiredDashboardSessions\u003c/code\u003e task for expiration enforcement. An attacker who has obtained a dashboard administrator session can continue to use it via \u003ccode\u003ePOST /recipe/dashboard/session/verify\u003c/code\u003e until the row is removed. Frequent Core restarts may prevent the 12-hour cleanup sweep, extending the window of access. The flaw does not allow for guessing or acquiring the random session identifier.\u003c/p\u003e\n","date_modified":"2026-11-09T21:59:35Z","date_published":"2026-11-09T21:59:35Z","id":"https://feed.craftedsignal.io/briefs/2026-11-supertokens-core-session-validation/","summary":"SuperTokens Core fails to validate dashboard session expiry at the API level, relying instead on a periodic cleanup task.","title":"SuperTokens Core: Dashboard session expiry validation bypass (CVE-2026-123799)","url":"https://feed.craftedsignal.io/briefs/2026-11-supertokens-core-session-validation/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:supertokens:core:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}