Race Condition in SuperTokens Core Authentication Server
CVE-2026-123804
What is CVE-2026-123804?
SuperTokens Core, an open-source authentication server, is vulnerable due to a race condition in session management. The flaw occurs when the createNewSession method resolves a primary user prior to unlinking associations from login methods. This allows attackers controlling the linked login method to exploit the timing gap, thereby maintaining an active session connected to the primary user’s identity, even after account unlinking and session revocation are initiated. The persistence of this session lasts until it expires or is revoked explicitly, posing potential risks to user security.
Affected Version(s)
supertokens-core >= 7.0.0, < 11.0.0 < 7.0.0, 11.0.0
supertokens-core >= 11.0.0, < 11.0.9 < 11.0.0, 11.0.9
supertokens-core >= 11.1.0, < 11.1.4 < 11.1.0, 11.1.4