Authentication Server Vulnerability in SuperTokens Affecting Multiple Versions
CVE-2026-123800
9.9CRITICAL
What is CVE-2026-123800?
An authorization failure in SuperTokens Core allows an attacker to manipulate the parent connection URI and parent domain. This vulnerability affects licensed multi-tenant deployments, where valid API keys can be exploited to make unauthorized updates that potentially compromise user sessions and applications. The incident highlights the importance of securing API keys and ensuring that permission checks are in place to prevent unauthorized access and modifications.
Affected Version(s)
supertokens-core >= 6.0.0, < 6.0.24 < 6.0.0, 6.0.24
supertokens-core >= 7.0.0, < 7.0.23 < 7.0.0, 7.0.23
supertokens-core >= 8.0.0, < 8.0.7 < 8.0.0, 8.0.7