Authentication Session Management Flaw in SuperTokens Core by SuperTokens
CVE-2026-123799
What is CVE-2026-123799?
SuperTokens Core, an open-source authentication server, contains a flaw in how it validates user sessions. Specifically, from version 11.0.0 through 11.0.9 and versions 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, and 12.1.2, the server recognizes any stored session row as valid without properly checking the expiration timestamp against the current time. This oversight permits an attacker to exploit stale session identifiers, enabling potential unauthorized access to the dashboard as long as the session remains intact. Even after the designated session lifespan of 30 days, the lack of scheduled expiration checks may allow continued use of these sessions until database cleanup occurs. The flaw, while serious, does not expose session identifiers, restricting the attack vector.
Affected Version(s)
supertokens-core >= 11.0.0, < 11.0.9 < 11.0.0, 11.0.9
supertokens-core >= 11.1.0, < 11.1.4 < 11.1.0, 11.1.4
supertokens-core >= 11.2.0, < 11.2.4 < 11.2.0, 11.2.4