{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/supertokens-core--6.0.0--12.3.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:supertokens:core:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-123800"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SuperTokens Core (\u003e= 6.0.0, \u003c 12.3.1)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["SuperTokens"],"content_html":"\u003cp\u003eSuperTokens Core, an open-source authentication server, is affected by an authorization bypass vulnerability (CVE-2026-123800) in the \u003ccode\u003eMultitenancy.checkPermissionsForCreateOrUpdate\u003c/code\u003e function. The vulnerability stems from inadequate authorization checks when processing updates to parent connection URI domains or the base tenant configuration. In multi-tenant deployments, an attacker possessing a valid API key for one application can exploit this logic flaw to modify the parent domain configuration, potentially impacting sibling applications.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized cross-tenant modifications. Observed impacts include the replacement of API keys, modification of sibling application user data, session hijacking, lockout of legitimate application administrators, and establishment of persistence via unauthorized dashboard user accounts. Additionally, manipulation of the base tenant target allows an attacker to alter authentication factors (firstFactors) and recipe-enabled flags, impacting service availability and login integrity.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade SuperTokens Core to the fixed versions (6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, or 12.3.1).\u003c/li\u003e\n\u003cli\u003eAudit current multi-tenant configurations for unauthorized modifications to \u003ccode\u003eapi_keys\u003c/code\u003e or authentication factor settings within the SuperTokens Core backend logs.\u003c/li\u003e\n\u003cli\u003eRestrict administrative access to the \u003ccode\u003emultitenancy\u003c/code\u003e API endpoints.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-10T02:08:24Z","date_published":"2026-11-10T02:08:24Z","id":"https://feed.craftedsignal.io/briefs/2026-11-supertokens-auth-bypass-9eaf51e5/","summary":"SuperTokens Core contains an authorization bypass vulnerability (CVE-2026-123800) allowing an attacker with a valid tenant API key to modify parent connection URIs and base tenant configurations, leading to potential cross-tenant account takeover and persistence.","title":"SuperTokens Core: Authorization bypass in Multitenancy module (CVE-2026-123800)","url":"https://feed.craftedsignal.io/briefs/2026-11-supertokens-auth-bypass-9eaf51e5/"}],"language":"en","title":"CraftedSignal Threat Feed - SuperTokens Core (\u003e= 6.0.0, \u003c 12.3.1)","version":"https://jsonfeed.org/version/1.1"}