{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/supertokens-core--11.3.0--11.3.7--11.4.0--11.4.7--12.0.0--12.0.10/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:supertokens:core:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-123798"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SuperTokens Core (\u003e= 11.3.0, \u003c 11.3.7; \u003e= 11.4.0, \u003c 11.4.7; \u003e= 12.0.0, \u003c 12.0.10)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["SuperTokens"],"content_html":"\u003cp\u003eSuperTokens Core (versions \u0026gt;= 11.3.0, \u0026lt; 11.3.7; \u0026gt;= 11.4.0, \u0026lt; 11.4.7; \u0026gt;= 12.0.0, \u0026lt; 12.0.10) contains an XML Signature Wrapping (XSW) vulnerability. The application fails to apply the necessary \u003ccode\u003eSAMLSignatureProfileValidator\u003c/code\u003e before calling \u003ccode\u003eOpenSAML\u003c/code\u003e for signature verification. This allows an attacker to manipulate a SAML response by moving a valid signature to an attacker-controlled identity element, leading to successful impersonation of other identity provider users. The issue impacts both response-level and assertion-level signing paths.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated user to perform authentication bypass and assume the identity of another user within the system.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade SuperTokens Core to version 11.3.7, 11.4.7, 12.0.10, or later.\u003c/li\u003e\n\u003cli\u003eReview authentication logs for anomalous account access patterns or rapid account switching by the same user session.\u003c/li\u003e\n\u003cli\u003eEvaluate the necessity of SAML configurations that allow user-provided XML signatures if specific patching is delayed.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T18:28:25Z","date_published":"2026-11-10T18:28:25Z","id":"https://feed.craftedsignal.io/briefs/2026-11-supertokens-xsw/","summary":"SuperTokens Core is vulnerable to XML Signature Wrapping (XSW) due to improper validation of SAML signatures, allowing authenticated users to impersonate other accounts.","title":"SuperTokens Core: XML Signature Wrapping vulnerability (CVE-2026-123798)","url":"https://feed.craftedsignal.io/briefs/2026-11-supertokens-xsw/"}],"language":"en","title":"CraftedSignal Threat Feed - SuperTokens Core (\u003e= 11.3.0, \u003c 11.3.7; \u003e= 11.4.0, \u003c 11.4.7; \u003e= 12.0.0, \u003c 12.0.10)","version":"https://jsonfeed.org/version/1.1"}