Cpe:2.3:a:supertokens:core:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3asupertokenscore/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 21:59:35 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSuperTokens Core: Dashboard session expiry validation bypass (CVE-2026-123799)https://feed.craftedsignal.io/briefs/2026-11-supertokens-core-session-validation/Mon, 09 Nov 2026 21:59:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-supertokens-core-session-validation/SuperTokens Core fails to validate dashboard session expiry at the API level, relying instead on a periodic cleanup task.SuperTokens Core versions 11.0.0 through 11.0.8, 11.1.0 through 11.1.3, 11.2.0 through 11.2.3, 11.3.0 through 11.3.7, 11.4.0 through 11.4.7, 12.0.0 through 12.0.10, and 12.1.0 through 12.1.1 contain a vulnerability where Dashboard.isValidUserSession and DashboardQueries.getSessionInfoWithSessionId do not compare DashboardSessionInfo.expiry to the current time.

Impact

The system relies on the DeleteExpiredDashboardSessions task for expiration enforcement. An attacker who has obtained a dashboard administrator session can continue to use it via POST /recipe/dashboard/session/verify until the row is removed. Frequent Core restarts may prevent the 12-hour cleanup sweep, extending the window of access. The flaw does not allow for guessing or acquiring the random session identifier.

]]>highadvisory