Product
SuperTokens Core contains an authorization bypass vulnerability (CVE-2026-123800) allowing an attacker with a valid tenant API key to modify parent connection URIs and base tenant configurations, leading to potential cross-tenant account takeover and persistence.