SuperTokens - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/supertokens/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 21:59:35 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSuperTokens Core: Dashboard session expiry validation bypass (CVE-2026-123799)https://feed.craftedsignal.io/briefs/2026-11-supertokens-core-session-validation/Mon, 09 Nov 2026 21:59:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-supertokens-core-session-validation/SuperTokens Core fails to validate dashboard session expiry at the API level, relying instead on a periodic cleanup task.SuperTokens Core versions 11.0.0 through 11.0.8, 11.1.0 through 11.1.3, 11.2.0 through 11.2.3, 11.3.0 through 11.3.7, 11.4.0 through 11.4.7, 12.0.0 through 12.0.10, and 12.1.0 through 12.1.1 contain a vulnerability where Dashboard.isValidUserSession and DashboardQueries.getSessionInfoWithSessionId do not compare DashboardSessionInfo.expiry to the current time.

Impact

The system relies on the DeleteExpiredDashboardSessions task for expiration enforcement. An attacker who has obtained a dashboard administrator session can continue to use it via POST /recipe/dashboard/session/verify until the row is removed. Frequent Core restarts may prevent the 12-hour cleanup sweep, extending the window of access. The flaw does not allow for guessing or acquiring the random session identifier.

]]>highadvisorySuperTokens Core: Authentication bypass via API-key and tenant enforcement (CVE-2026-123797)https://feed.craftedsignal.io/briefs/2026-11-supertokens-auth-bypass/Mon, 09 Nov 2026 19:57:27 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-supertokens-auth-bypass/SuperTokens Core versions prior to 11.3.6, 11.4.6, and 12.0.8 are vulnerable to an authentication bypass that allows unauthenticated role management due to improper handling of tenant paths and CDI versions.SuperTokens Core contains an authentication bypass vulnerability (CVE-2026-123797) affecting versions prior to 11.3.6, 11.4.6, and 12.0.8. An unauthenticated attacker capable of reaching the Core endpoint can use unknown tenant paths combined with older supported CDI versions to bypass API-key and public-tenant enforcement. This occurs because the checkIPAccess and assertThatAPIKeyCheckPasses functions suppress TenantOrAppNotFoundException, and the public-tenant guard only applies to CDI versions 5.0 and later.

Impact

Successful exploitation allows an unauthenticated attacker to create and enumerate application roles by sending crafted requests to the Core API, such as PUT /ghosttenant/recipe/role and GET /ghosttenant/recipe/roles.

Recommendation

  • Patch SuperTokens Core by upgrading to versions 11.3.6, 11.4.6, or 12.0.8 immediately.
  • Audit access logs for requests involving /ghosttenant/ or unconventional tenant paths targeting role management endpoints.
  • Restrict network access to the SuperTokens Core API endpoint to trusted infrastructure only.
]]>highadvisory