SuperTokens Core (>= 11.3.0, < 11.3.7; >= 11.4.0, < 11.4.7; >= 12.0.0, < 12.0.10) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/supertokens-core--11.3.0--11.3.7--11.4.0--11.4.7--12.0.0--12.0.10/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 18:28:25 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSuperTokens Core: XML Signature Wrapping vulnerability (CVE-2026-123798)https://feed.craftedsignal.io/briefs/2026-11-supertokens-xsw/Tue, 10 Nov 2026 18:28:25 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-supertokens-xsw/SuperTokens Core is vulnerable to XML Signature Wrapping (XSW) due to improper validation of SAML signatures, allowing authenticated users to impersonate other accounts.SuperTokens Core (versions >= 11.3.0, < 11.3.7; >= 11.4.0, < 11.4.7; >= 12.0.0, < 12.0.10) contains an XML Signature Wrapping (XSW) vulnerability. The application fails to apply the necessary SAMLSignatureProfileValidator before calling OpenSAML for signature verification. This allows an attacker to manipulate a SAML response by moving a valid signature to an attacker-controlled identity element, leading to successful impersonation of other identity provider users. The issue impacts both response-level and assertion-level signing paths.

Impact

Successful exploitation allows an authenticated user to perform authentication bypass and assume the identity of another user within the system.

Recommendation

  • Upgrade SuperTokens Core to version 11.3.7, 11.4.7, 12.0.10, or later.
  • Review authentication logs for anomalous account access patterns or rapid account switching by the same user session.
  • Evaluate the necessity of SAML configurations that allow user-provided XML signatures if specific patching is delayed.
]]>highadvisory