SuperTokens Core is an open source authentication server.
SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform application-scoped WebAuthn lookups without constraining them to the requested tenant, and WebAuthN.signIn does not verify tenant membership. In a multi-tenant deployment using WebAuthn with a shared user pool, an ordinary user who possesses their own valid passkey in one tenant can submit its assertion to another tenant's sign-in endpoint in the same application and be authenticated there despite having no membership in the target tenant. This issue is fixed in ve
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Supertokens
- Product
- supertokens-core
- CVSS v3.1
- 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Fix
- available
- Weakness
- CWE-863, CWE-1220
- Exposure class
- Identity
- NVD status
- Received
Why it ranks 42 (Notable)
- CVSS v3.1 8.1 high
- Exposed product class: identity
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-123803 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.