SuperTokens Core (11.3.0-11.3.7) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/supertokens-core-11.3.0-11.3.7/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 20:36:48 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSuperTokens Core: SAML Authentication Replay Vulnerability (CVE-2026-123801)https://feed.craftedsignal.io/briefs/2026-11-supertokens-saml-replay/Tue, 10 Nov 2026 20:36:48 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-supertokens-saml-replay/SuperTokens Core fails to properly validate SAML assertions, allowing for replay attacks and identity spoofing in specific configurations.SuperTokens Core versions 11.3.0 through 11.3.7, 11.4.0 through 11.4.7, 12.0.0 through 12.0.10, 12.1.0 through 12.1.1, 12.2.0, and 12.3.0 are vulnerable to SAML assertion replay and identity spoofing. The SAML.handleCallback function does not consume RelayState, record assertion identifiers, or enforce Response.InResponseTo.

In SP-initiated flows, attackers can resubmit valid SAML responses to /recipe/saml/callback before the NotOnOrAfter time. In IdP-initiated flows, assertions can be replayed without RelayState. Additionally, missing checks for Destination, SubjectConfirmationData Recipient, and NotOnOrAfter allow accepted callbacks to mint new authorization codes. The application also fails to enforce allowIDPInitiatedLogin=false.

]]>highadvisory