Authentication Flaw in SuperTokens Core Affects Multiple Versions
CVE-2026-123801
What is CVE-2026-123801?
SuperTokens Core, an open-source authentication server, has a security vulnerability in its SAML authentication flow for versions 11.3.0 through 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1. The vulnerability arises from the mishandling of the RelayState parameter and the absence of important validation checks on response assertions, such as Response.InResponseTo, which could allow attackers to replay legitimate SAML assertions under certain conditions. Consequently, this oversight can enable unauthorized users to complete an authentication process with an assertion belonging to a different identity. Mitigation is available in subsequent updates, ensuring the integrity and security of authentication processes.
Affected Version(s)
supertokens-core >= 11.3.0, < 11.3.8 < 11.3.0, 11.3.8
supertokens-core >= 11.4.0, < 11.4.8 < 11.4.0, 11.4.8
supertokens-core >= 12.0.0, < 12.0.11 < 12.0.0, 12.0.11