ورود / ثبت‌نام

جزئیات آسیب‌پذیری

CVE-2026-123800

supertokens supertokens-core

SuperTokens Core: App-scoped API key can overwrite the parent connection URI domain's credentials and take over sibling applications

CVSS 3.1
9.9بحرانی

شرح رسمی (انگلیسی)

SuperTokens Core is an open source authentication server. From 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, Multitenancy.checkPermissionsForCreateOrUpdate in src/main/java/io/supertokens/multitenancy/Multitenancy.java does not adequately authorize updates to a parent connection URI domain or the base tenant. In a licensed multi-tenant deployment with multiple applications under one non-default connection URI domain and separate api_keys, an attacker holding one application's valid API key can update the parent domain because the CUD-target branch checks the domain without requiring the source application and tenant to be public. Because api_keys is not protected, the attacker can replace the parent key and then sibling application keys, read or modify sibling users, obtain sessions as those users, establish persistence through a sibling dashboard user, and lock out the sibling application's own key. In the advisory's v2 create or update handlers, omitting the optional identifier produces a base-tenant target that skips the permission branches and enterprise-feature gate, allowing changes to firstFactors, required secondary factors, and recipe-enabled flags that affect login integrity and availability. The base-target variant still rejects coreConfig and does not establish key theft. This issue is fixed in versions 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.

امتیازهای CVSS

امتیازنسخهمنبعبردار
9.9بحرانی 3.1 CVEProject cvelistV5 (CNA) (GitHub_M) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

محصولات آسیب‌پذیر

فروشندهمحصولنسخه‌هامنبع
supertokens supertokens-core >= 10.0.0, < 10.0.8 CVEProject cvelistV5 (CNA)
supertokens supertokens-core >= 10.1.0, < 10.1.9 CVEProject cvelistV5 (CNA)
supertokens supertokens-core >= 11.0.0, < 11.0.9 CVEProject cvelistV5 (CNA)
supertokens supertokens-core >= 11.1.0, < 11.1.4 CVEProject cvelistV5 (CNA)
supertokens supertokens-core >= 11.2.0, < 11.2.4 CVEProject cvelistV5 (CNA)
supertokens supertokens-core >= 11.3.0, < 11.3.8 CVEProject cvelistV5 (CNA)
supertokens supertokens-core >= 11.4.0, < 11.4.8 CVEProject cvelistV5 (CNA)
supertokens supertokens-core >= 12.0.0, < 12.0.11 CVEProject cvelistV5 (CNA)
supertokens supertokens-core >= 12.1.0, < 12.1.2 CVEProject cvelistV5 (CNA)
supertokens supertokens-core >= 12.2.0, < 12.2.1 CVEProject cvelistV5 (CNA)
supertokens supertokens-core >= 12.3.0, < 12.3.1 CVEProject cvelistV5 (CNA)
supertokens supertokens-core >= 6.0.0, < 6.0.24 CVEProject cvelistV5 (CNA)
supertokens supertokens-core >= 7.0.0, < 7.0.23 CVEProject cvelistV5 (CNA)
supertokens supertokens-core >= 8.0.0, < 8.0.7 CVEProject cvelistV5 (CNA)
supertokens supertokens-core >= 9.0.0, < 9.0.6 CVEProject cvelistV5 (CNA)
supertokens supertokens-core >= 9.1.0, < 9.1.6 CVEProject cvelistV5 (CNA)
supertokens supertokens-core >= 9.2.0, < 9.2.7 CVEProject cvelistV5 (CNA)
supertokens supertokens-core >= 9.3.0, < 9.3.5 CVEProject cvelistV5 (CNA)

منابع و راهنماها

۳۷
کانال تلگرام کُلون @kolunsec_fa تازه‌های KEV، خبرهای مهم و خلاصه‌ی روزانه هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.

اطلاعات

تاریخ انتشار
۱۴۰۵/۰۸/۱۸
آخرین به‌روزرسانی
۱۴۰۵/۰۸/۱۸
وضعیت
منتشرشده
صادرکننده (CNA)
GitHub_M
اولویت کُلون
۲۷ · پایین

پیش‌بینی بهره‌برداری (EPSS)

۰٫۵۸٪
احتمال بهره‌برداری در ۳۰ روز
۴۸٫۵٪
صدک (نسبت به همه‌ی CVEها)

ضعف‌ها (CWE)

  • CWE-639
    Authorization Bypass Through User-Controlled Key
  • CWE-863
    Incorrect Authorization