{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/supertokens/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:supertokens:core:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-123799"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SuperTokens Core (11.0.0-11.0.8)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["SuperTokens"],"content_html":"\u003cp\u003eSuperTokens Core versions 11.0.0 through 11.0.8, 11.1.0 through 11.1.3, 11.2.0 through 11.2.3, 11.3.0 through 11.3.7, 11.4.0 through 11.4.7, 12.0.0 through 12.0.10, and 12.1.0 through 12.1.1 contain a vulnerability where \u003ccode\u003eDashboard.isValidUserSession\u003c/code\u003e and \u003ccode\u003eDashboardQueries.getSessionInfoWithSessionId\u003c/code\u003e do not compare \u003ccode\u003eDashboardSessionInfo.expiry\u003c/code\u003e to the current time.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe system relies on the \u003ccode\u003eDeleteExpiredDashboardSessions\u003c/code\u003e task for expiration enforcement. An attacker who has obtained a dashboard administrator session can continue to use it via \u003ccode\u003ePOST /recipe/dashboard/session/verify\u003c/code\u003e until the row is removed. Frequent Core restarts may prevent the 12-hour cleanup sweep, extending the window of access. The flaw does not allow for guessing or acquiring the random session identifier.\u003c/p\u003e\n","date_modified":"2026-11-09T21:59:35Z","date_published":"2026-11-09T21:59:35Z","id":"https://feed.craftedsignal.io/briefs/2026-11-supertokens-core-session-validation/","summary":"SuperTokens Core fails to validate dashboard session expiry at the API level, relying instead on a periodic cleanup task.","title":"SuperTokens Core: Dashboard session expiry validation bypass (CVE-2026-123799)","url":"https://feed.craftedsignal.io/briefs/2026-11-supertokens-core-session-validation/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:supertokens:supertokens_core:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-123797"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SuperTokens Core (\u003c 11.3.6, 11.4.6, 12.0.8)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["SuperTokens"],"content_html":"\u003cp\u003eSuperTokens Core contains an authentication bypass vulnerability (CVE-2026-123797) affecting versions prior to 11.3.6, 11.4.6, and 12.0.8. An unauthenticated attacker capable of reaching the Core endpoint can use unknown tenant paths combined with older supported CDI versions to bypass API-key and public-tenant enforcement. This occurs because the \u003ccode\u003echeckIPAccess\u003c/code\u003e and \u003ccode\u003eassertThatAPIKeyCheckPasses\u003c/code\u003e functions suppress \u003ccode\u003eTenantOrAppNotFoundException\u003c/code\u003e, and the public-tenant guard only applies to CDI versions 5.0 and later.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to create and enumerate application roles by sending crafted requests to the Core API, such as \u003ccode\u003ePUT /ghosttenant/recipe/role\u003c/code\u003e and \u003ccode\u003eGET /ghosttenant/recipe/roles\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch SuperTokens Core by upgrading to versions 11.3.6, 11.4.6, or 12.0.8 immediately.\u003c/li\u003e\n\u003cli\u003eAudit access logs for requests involving \u003ccode\u003e/ghosttenant/\u003c/code\u003e or unconventional tenant paths targeting role management endpoints.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the SuperTokens Core API endpoint to trusted infrastructure only.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T19:57:27Z","date_published":"2026-11-09T19:57:27Z","id":"https://feed.craftedsignal.io/briefs/2026-11-supertokens-auth-bypass/","summary":"SuperTokens Core versions prior to 11.3.6, 11.4.6, and 12.0.8 are vulnerable to an authentication bypass that allows unauthenticated role management due to improper handling of tenant paths and CDI versions.","title":"SuperTokens Core: Authentication bypass via API-key and tenant enforcement (CVE-2026-123797)","url":"https://feed.craftedsignal.io/briefs/2026-11-supertokens-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - SuperTokens","version":"https://jsonfeed.org/version/1.1"}