XML Signature Wrapping Vulnerability in SuperTokens Core Authentication Server
CVE-2026-123798
What is CVE-2026-123798?
A security flaw in SuperTokens Core allows potential exploitation through XML Signature Wrapping. Specifically, the function SAML.verifySamlResponseSignature improperly handles security checks during signature validation. This oversight enables an attacker to craft a malicious identity-bearing XML element, while still presenting a legitimately signed element relocated within the document. Such a scenario could lead to unauthorized authentication as an alternative identity provider (IdP) user, affecting both response and assertion signing paths. Mitigating this risk requires upgrading to fixed versions 11.3.7, 11.4.7, or 12.0.10.
Affected Version(s)
supertokens-core >= 12.0.6, < 12.0.10 < 12.0.6, 12.0.10
supertokens-core >= 11.4.0, < 11.4.7 < 11.4.0, 11.4.7
supertokens-core >= 11.3.0, < 11.3.7 < 11.3.0, 11.3.7