Authentication Bypass in SuperTokens Core by Valid Passkey
CVE-2026-123803
8.1HIGH
What is CVE-2026-123803?
In certain versions of SuperTokens Core, an issue exists where WebAuthn functions do not correctly enforce tenant restrictions. This allows an authenticated user from one tenant to inadvertently access resources or auth tokens from another tenant if they possess valid credentials. This flaw can lead to unauthorized access in multi-tenant environments, compromising the security of user data.
Affected Version(s)
supertokens-core >= 10.1.0, < 11.0.0 < 10.1.0, 11.0.0
supertokens-core >= 11.0.0, < 11.0.9 < 11.0.0, 11.0.9
supertokens-core >= 11.1.0, < 11.1.4 < 11.1.0, 11.1.4