{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3asupertokenssupertokens_core/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:supertokens:supertokens_core:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-123797"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SuperTokens Core (\u003c 11.3.6, 11.4.6, 12.0.8)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["SuperTokens"],"content_html":"\u003cp\u003eSuperTokens Core contains an authentication bypass vulnerability (CVE-2026-123797) affecting versions prior to 11.3.6, 11.4.6, and 12.0.8. An unauthenticated attacker capable of reaching the Core endpoint can use unknown tenant paths combined with older supported CDI versions to bypass API-key and public-tenant enforcement. This occurs because the \u003ccode\u003echeckIPAccess\u003c/code\u003e and \u003ccode\u003eassertThatAPIKeyCheckPasses\u003c/code\u003e functions suppress \u003ccode\u003eTenantOrAppNotFoundException\u003c/code\u003e, and the public-tenant guard only applies to CDI versions 5.0 and later.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to create and enumerate application roles by sending crafted requests to the Core API, such as \u003ccode\u003ePUT /ghosttenant/recipe/role\u003c/code\u003e and \u003ccode\u003eGET /ghosttenant/recipe/roles\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch SuperTokens Core by upgrading to versions 11.3.6, 11.4.6, or 12.0.8 immediately.\u003c/li\u003e\n\u003cli\u003eAudit access logs for requests involving \u003ccode\u003e/ghosttenant/\u003c/code\u003e or unconventional tenant paths targeting role management endpoints.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the SuperTokens Core API endpoint to trusted infrastructure only.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T19:57:27Z","date_published":"2026-11-09T19:57:27Z","id":"https://feed.craftedsignal.io/briefs/2026-11-supertokens-auth-bypass/","summary":"SuperTokens Core versions prior to 11.3.6, 11.4.6, and 12.0.8 are vulnerable to an authentication bypass that allows unauthenticated role management due to improper handling of tenant paths and CDI versions.","title":"SuperTokens Core: Authentication bypass via API-key and tenant enforcement (CVE-2026-123797)","url":"https://feed.craftedsignal.io/briefs/2026-11-supertokens-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:supertokens:supertokens_core:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}