Vulnerability details

CVE-2026-123800

supertokens supertokens-core

SuperTokens Core: App-scoped API key can overwrite the parent connection URI domain's credentials and take over sibling applications

CVSS 3.1

9.9Critical

Official description

SuperTokens Core is an open source authentication server. From 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, Multitenancy.checkPermissionsForCreateOrUpdate in src/main/java/io/supertokens/multitenancy/Multitenancy.java does not adequately authorize updates to a parent connection URI domain or the base tenant. In a licensed multi-tenant deployment with multiple applications under one non-default connection URI domain and separate api_keys, an attacker holding one application's valid API key can update the parent domain because the CUD-target branch checks the domain without requiring the source application and tenant to be public. Because api_keys is not protected, the attacker can replace the parent key and then sibling application keys, read or modify sibling users, obtain sessions as those users, establish persistence through a sibling dashboard user, and lock out the sibling application's own key. In the advisory's v2 create or update handlers, omitting the optional identifier produces a base-tenant target that skips the permission branches and enterprise-feature gate, allowing changes to firstFactors, required secondary factors, and recipe-enabled flags that affect login integrity and availability. The base-target variant still rejects coreConfig and does not establish key theft. This issue is fixed in versions 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.

CVSS scores

Score	Version	Source	Vector
9.9Critical	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
supertokens	supertokens-core	>= 10.0.0, < 10.0.8	CVEProject cvelistV5 (CNA)
supertokens	supertokens-core	>= 10.1.0, < 10.1.9	CVEProject cvelistV5 (CNA)
supertokens	supertokens-core	>= 11.0.0, < 11.0.9	CVEProject cvelistV5 (CNA)
supertokens	supertokens-core	>= 11.1.0, < 11.1.4	CVEProject cvelistV5 (CNA)
supertokens	supertokens-core	>= 11.2.0, < 11.2.4	CVEProject cvelistV5 (CNA)
supertokens	supertokens-core	>= 11.3.0, < 11.3.8	CVEProject cvelistV5 (CNA)
supertokens	supertokens-core	>= 11.4.0, < 11.4.8	CVEProject cvelistV5 (CNA)
supertokens	supertokens-core	>= 12.0.0, < 12.0.11	CVEProject cvelistV5 (CNA)
supertokens	supertokens-core	>= 12.1.0, < 12.1.2	CVEProject cvelistV5 (CNA)
supertokens	supertokens-core	>= 12.2.0, < 12.2.1	CVEProject cvelistV5 (CNA)
supertokens	supertokens-core	>= 12.3.0, < 12.3.1	CVEProject cvelistV5 (CNA)
supertokens	supertokens-core	>= 6.0.0, < 6.0.24	CVEProject cvelistV5 (CNA)
supertokens	supertokens-core	>= 7.0.0, < 7.0.23	CVEProject cvelistV5 (CNA)
supertokens	supertokens-core	>= 8.0.0, < 8.0.7	CVEProject cvelistV5 (CNA)
supertokens	supertokens-core	>= 9.0.0, < 9.0.6	CVEProject cvelistV5 (CNA)
supertokens	supertokens-core	>= 9.1.0, < 9.1.6	CVEProject cvelistV5 (CNA)
supertokens	supertokens-core	>= 9.2.0, < 9.2.7	CVEProject cvelistV5 (CNA)
supertokens	supertokens-core	>= 9.3.0, < 9.3.5	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/supertokens/supertokens-core/security/advisories/GHSA-4rf2-xqvf-8rcx x_refsource_CONFIRM
https://github.com/supertokens/supertokens-core/commit/13c3de170dd40dd217db0f6bd2bded0948476a42 x_refsource_MISC
https://github.com/supertokens/supertokens-core/commit/1cc02b971f064c2fa2d9bc74b9e85795fdc6a7e5 x_refsource_MISC
https://github.com/supertokens/supertokens-core/commit/1d9dcb03ce0691d9b8abee48f86cc2729a6008cb x_refsource_MISC
https://github.com/supertokens/supertokens-core/commit/337bb3eba812a5ee52d57854701820a0580b6050 x_refsource_MISC
https://github.com/supertokens/supertokens-core/commit/4902b713f31306ca41148070d10b6185f0e85201 x_refsource_MISC
https://github.com/supertokens/supertokens-core/commit/4d1ef0e177681f4f74995e4a25a17d224effe115 x_refsource_MISC
https://github.com/supertokens/supertokens-core/commit/61bfd3ebde1cf4b092da85ee884fa15e288aad51 x_refsource_MISC
https://github.com/supertokens/supertokens-core/commit/64dfa92c50a2ec288fe787ee5c2fad45548a6475 x_refsource_MISC
https://github.com/supertokens/supertokens-core/commit/8db9b0c39f97f240e116821434d4eb3c907faccf x_refsource_MISC
https://github.com/supertokens/supertokens-core/commit/8e48ef856becbaaeb50ad4c915be1d7ce279416b x_refsource_MISC
https://github.com/supertokens/supertokens-core/commit/9b0d3a9fdbdcb48dd7dd9d520075bbefbae3cf9b x_refsource_MISC
https://github.com/supertokens/supertokens-core/commit/a186f1013c784de8a796a732e925e1870fec0f40 x_refsource_MISC
https://github.com/supertokens/supertokens-core/commit/b58bc3d03549d20495df71c03ef5478799c184db x_refsource_MISC
https://github.com/supertokens/supertokens-core/commit/bf6184f027a99bd1b3b1df3d20e376dda6521399 x_refsource_MISC
https://github.com/supertokens/supertokens-core/commit/c6d7dc7d73b9bb3075b3f7a1a0c0c5780430c292 x_refsource_MISC
https://github.com/supertokens/supertokens-core/commit/df79f3b4399ef31aea4cb44cc7b65761a2cb94a7 x_refsource_MISC
https://github.com/supertokens/supertokens-core/commit/e616f4002c31d256f9ff6cb3d3685b924ef53a6d x_refsource_MISC
https://github.com/supertokens/supertokens-core/commit/ff9ca3ec53861a91996c4e9581fa6f2e01331736 x_refsource_MISC
https://github.com/supertokens/supertokens-core/releases/tag/v10.0.8 x_refsource_MISC
https://github.com/supertokens/supertokens-core/releases/tag/v10.1.9 x_refsource_MISC
https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9 x_refsource_MISC
https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4 x_refsource_MISC
https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4 x_refsource_MISC
https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8 x_refsource_MISC
https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8 x_refsource_MISC
https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11 x_refsource_MISC
https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2 x_refsource_MISC
https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1 x_refsource_MISC
https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1 x_refsource_MISC
https://github.com/supertokens/supertokens-core/releases/tag/v6.0.24 x_refsource_MISC
https://github.com/supertokens/supertokens-core/releases/tag/v7.0.23 x_refsource_MISC
https://github.com/supertokens/supertokens-core/releases/tag/v8.0.7 x_refsource_MISC
https://github.com/supertokens/supertokens-core/releases/tag/v9.0.6 x_refsource_MISC
https://github.com/supertokens/supertokens-core/releases/tag/v9.1.6 x_refsource_MISC
https://github.com/supertokens/supertokens-core/releases/tag/v9.2.7 x_refsource_MISC
https://github.com/supertokens/supertokens-core/releases/tag/v9.3.5 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-11-09
Last updated: 2026-11-09
State: Published
Assigner (CNA): GitHub_M
Kolun priority: 27 · Low

Exploit prediction (EPSS)

0.58%

Probability of exploitation in 30 days

48.5%

Percentile (among all CVEs)

Weaknesses (CWE)

CWE-639
Authorization Bypass Through User-Controlled Key
CWE-863
Incorrect Authorization