Authentication Bypass in SuperTokens Core Affects Multiple Versions
CVE-2026-123797
7.5HIGH
What is CVE-2026-123797?
SuperTokens Core, an open source authentication server, has a vulnerability that allows unauthenticated users to bypass API key enforcement when making app-specific management requests. This occurs when an unknown tenant path is used along with an older supported CDI version. The issue stems from the suppression of exceptions in the API's logic, which grants unauthorized access to endpoints capable of creating and listing application roles. This issue has been resolved in SuperTokens Core versions 11.3.6, 11.4.6, and 12.0.8.
Affected Version(s)
supertokens-core < 11.3.6 < 11.3.6
supertokens-core >= 11.4.0, < 11.4.6 < 11.4.0, 11.4.6
supertokens-core >= 12.0.6, < 12.0.8 < 12.0.6, 12.0.8