SAML Authentication Bypass in SuperTokens Core - Mitigating Security Risks
CVE-2026-123802
What is CVE-2026-123802?
A vulnerability in SuperTokens Core affects versions 11.3.0 through 11.4.8 and 12.0.11 through 12.3.1, allowing attackers to authenticate as a victim user via crafted SAML assertions. This occurs when an identity provider's signed assertion fails the audience check but is improperly validated by the SuperTokens' server. Attackers can potentially exploit this flaw by combining valid assertions targeting different audiences, leading to unauthorized access to user accounts. Mitigations have been implemented in subsequent software releases, emphasizing the importance of upgrading to secure versions.
Affected Version(s)
supertokens-core >= 11.3.0, < 11.3.8 < 11.3.0, 11.3.8
supertokens-core >= 11.4.0, < 11.4.8 < 11.4.0, 11.4.8
supertokens-core >= 12.0.0, < 12.0.11 < 12.0.0, 12.0.11