SuperTokens Core is an open source authentication server.
SuperTokens Core is an open source authentication server. From 11.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, and 12.1.2, Dashboard.isValidUserSession treats any stored session row as valid without comparing DashboardSessionInfo.expiry to the current time. DashboardQueries.getSessionInfoWithSessionId also selects by app and session identifier without an expiry predicate, leaving the periodic DeleteExpiredDashboardSessions cleanup as the only expiration enforcement. An attacker who obtains a dashboard administrator session after its 30-day lifetime can continue using POST /recipe/dashboard/session/verify until the row is removed, and frequent Core restarts can prevent the 12-ho
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Supertokens
- Product
- supertokens-core
- CVSS v3.1
- 7.4 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Fix
- available
- Weakness
- CWE-613
- Exposure class
- Identity
- NVD status
- Received
Why it ranks 42 (Notable)
- CVSS v3.1 7.4 high
- Exposed product class: identity
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-123799 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.