Cpe:2.3:a:supertokens:supertokens_core:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3asupertokenssupertokens_core/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 19:57:27 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSuperTokens Core: Authentication bypass via API-key and tenant enforcement (CVE-2026-123797)https://feed.craftedsignal.io/briefs/2026-11-supertokens-auth-bypass/Mon, 09 Nov 2026 19:57:27 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-supertokens-auth-bypass/SuperTokens Core versions prior to 11.3.6, 11.4.6, and 12.0.8 are vulnerable to an authentication bypass that allows unauthenticated role management due to improper handling of tenant paths and CDI versions.SuperTokens Core contains an authentication bypass vulnerability (CVE-2026-123797) affecting versions prior to 11.3.6, 11.4.6, and 12.0.8. An unauthenticated attacker capable of reaching the Core endpoint can use unknown tenant paths combined with older supported CDI versions to bypass API-key and public-tenant enforcement. This occurs because the checkIPAccess and assertThatAPIKeyCheckPasses functions suppress TenantOrAppNotFoundException, and the public-tenant guard only applies to CDI versions 5.0 and later.

Impact

Successful exploitation allows an unauthenticated attacker to create and enumerate application roles by sending crafted requests to the Core API, such as PUT /ghosttenant/recipe/role and GET /ghosttenant/recipe/roles.

Recommendation

  • Patch SuperTokens Core by upgrading to versions 11.3.6, 11.4.6, or 12.0.8 immediately.
  • Audit access logs for requests involving /ghosttenant/ or unconventional tenant paths targeting role management endpoints.
  • Restrict network access to the SuperTokens Core API endpoint to trusted infrastructure only.
]]>highadvisory