SuperTokens Core (>= 6.0.0, < 12.3.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/supertokens-core--6.0.0--12.3.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 02:08:24 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSuperTokens Core: Authorization bypass in Multitenancy module (CVE-2026-123800)https://feed.craftedsignal.io/briefs/2026-11-supertokens-auth-bypass-9eaf51e5/Tue, 10 Nov 2026 02:08:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-supertokens-auth-bypass-9eaf51e5/SuperTokens Core contains an authorization bypass vulnerability (CVE-2026-123800) allowing an attacker with a valid tenant API key to modify parent connection URIs and base tenant configurations, leading to potential cross-tenant account takeover and persistence.SuperTokens Core, an open-source authentication server, is affected by an authorization bypass vulnerability (CVE-2026-123800) in the Multitenancy.checkPermissionsForCreateOrUpdate function. The vulnerability stems from inadequate authorization checks when processing updates to parent connection URI domains or the base tenant configuration. In multi-tenant deployments, an attacker possessing a valid API key for one application can exploit this logic flaw to modify the parent domain configuration, potentially impacting sibling applications.

Impact

Successful exploitation allows unauthorized cross-tenant modifications. Observed impacts include the replacement of API keys, modification of sibling application user data, session hijacking, lockout of legitimate application administrators, and establishment of persistence via unauthorized dashboard user accounts. Additionally, manipulation of the base tenant target allows an attacker to alter authentication factors (firstFactors) and recipe-enabled flags, impacting service availability and login integrity.

Recommendation

  1. Upgrade SuperTokens Core to the fixed versions (6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, or 12.3.1).
  2. Audit current multi-tenant configurations for unauthorized modifications to api_keys or authentication factor settings within the SuperTokens Core backend logs.
  3. Restrict administrative access to the multitenancy API endpoints.
]]>criticaladvisory