{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/supertokens-core-11.3.0-11.3.7/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:supertokens:core:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-123801"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SuperTokens Core (11.3.0-11.3.7)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["SuperTokens"],"content_html":"\u003cp\u003eSuperTokens Core versions 11.3.0 through 11.3.7, 11.4.0 through 11.4.7, 12.0.0 through 12.0.10, 12.1.0 through 12.1.1, 12.2.0, and 12.3.0 are vulnerable to SAML assertion replay and identity spoofing. The \u003ccode\u003eSAML.handleCallback\u003c/code\u003e function does not consume RelayState, record assertion identifiers, or enforce \u003ccode\u003eResponse.InResponseTo\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eIn SP-initiated flows, attackers can resubmit valid SAML responses to \u003ccode\u003e/recipe/saml/callback\u003c/code\u003e before the \u003ccode\u003eNotOnOrAfter\u003c/code\u003e time. In IdP-initiated flows, assertions can be replayed without RelayState. Additionally, missing checks for \u003ccode\u003eDestination\u003c/code\u003e, \u003ccode\u003eSubjectConfirmationData\u003c/code\u003e \u003ccode\u003eRecipient\u003c/code\u003e, and \u003ccode\u003eNotOnOrAfter\u003c/code\u003e allow accepted callbacks to mint new authorization codes. The application also fails to enforce \u003ccode\u003eallowIDPInitiatedLogin=false\u003c/code\u003e.\u003c/p\u003e\n","date_modified":"2026-11-10T20:36:48Z","date_published":"2026-11-10T20:36:48Z","id":"https://feed.craftedsignal.io/briefs/2026-11-supertokens-saml-replay/","summary":"SuperTokens Core fails to properly validate SAML assertions, allowing for replay attacks and identity spoofing in specific configurations.","title":"SuperTokens Core: SAML Authentication Replay Vulnerability (CVE-2026-123801)","url":"https://feed.craftedsignal.io/briefs/2026-11-supertokens-saml-replay/"}],"language":"en","title":"CraftedSignal Threat Feed - SuperTokens Core (11.3.0-11.3.7)","version":"https://jsonfeed.org/version/1.1"}