Description
SuperTokens Core is an open source authentication server. From 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, Multitenancy.checkPermissionsForCreateOrUpdate in src/main/java/io/supertokens/multitenancy/Multitenancy.java does not adequately authorize updates to a parent connection URI domain or the base tenant. In a licensed multi-tenant deployment with multiple applications under one non-default connection URI domain and separate api_keys, an attacker holding one application's valid API key can update the parent domain because the CUD-target branch checks the domain without requiring the source application and tenant to be public. Because api_keys is not protected, the attacker can replace the parent key and then sibling application keys, read or modify sibling users, obtain sessions as those users, establish persistence through a sibling dashboard user, and lock out the sibling application's own key. In the advisory's v2 create or update handlers, omitting the optional identifier produces a base-tenant target that skips the permission branches and enterprise-feature gate, allowing changes to firstFactors, required secondary factors, and recipe-enabled flags that affect login integrity and availability. The base-target variant still rejects coreConfig and does not establish key theft. This issue is fixed in versions 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Published: 2026-11-09
Score: 9.9 Critical
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://github.com/supertokens/supertokens-core/commit/13c3de170dd40dd217db0f6bd2bded0948476a42 cve-icon
https://github.com/supertokens/supertokens-core/commit/1cc02b971f064c2fa2d9bc74b9e85795fdc6a7e5 cve-icon
https://github.com/supertokens/supertokens-core/commit/1d9dcb03ce0691d9b8abee48f86cc2729a6008cb cve-icon
https://github.com/supertokens/supertokens-core/commit/337bb3eba812a5ee52d57854701820a0580b6050 cve-icon
https://github.com/supertokens/supertokens-core/commit/4902b713f31306ca41148070d10b6185f0e85201 cve-icon
https://github.com/supertokens/supertokens-core/commit/4d1ef0e177681f4f74995e4a25a17d224effe115 cve-icon
https://github.com/supertokens/supertokens-core/commit/61bfd3ebde1cf4b092da85ee884fa15e288aad51 cve-icon
https://github.com/supertokens/supertokens-core/commit/64dfa92c50a2ec288fe787ee5c2fad45548a6475 cve-icon
https://github.com/supertokens/supertokens-core/commit/8db9b0c39f97f240e116821434d4eb3c907faccf cve-icon
https://github.com/supertokens/supertokens-core/commit/8e48ef856becbaaeb50ad4c915be1d7ce279416b cve-icon
https://github.com/supertokens/supertokens-core/commit/9b0d3a9fdbdcb48dd7dd9d520075bbefbae3cf9b cve-icon
https://github.com/supertokens/supertokens-core/commit/a186f1013c784de8a796a732e925e1870fec0f40 cve-icon
https://github.com/supertokens/supertokens-core/commit/b58bc3d03549d20495df71c03ef5478799c184db cve-icon
https://github.com/supertokens/supertokens-core/commit/bf6184f027a99bd1b3b1df3d20e376dda6521399 cve-icon
https://github.com/supertokens/supertokens-core/commit/c6d7dc7d73b9bb3075b3f7a1a0c0c5780430c292 cve-icon
https://github.com/supertokens/supertokens-core/commit/df79f3b4399ef31aea4cb44cc7b65761a2cb94a7 cve-icon
https://github.com/supertokens/supertokens-core/commit/e616f4002c31d256f9ff6cb3d3685b924ef53a6d cve-icon
https://github.com/supertokens/supertokens-core/commit/ff9ca3ec53861a91996c4e9581fa6f2e01331736 cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v10.0.8 cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v10.1.9 cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9 cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4 cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4 cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8 cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8 cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11 cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2 cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1 cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1 cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v6.0.24 cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v7.0.23 cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v8.0.7 cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v9.0.6 cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v9.1.6 cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v9.2.7 cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v9.3.5 cve-icon
https://github.com/supertokens/supertokens-core/security/advisories/GHSA-4rf2-xqvf-8rcx cve-icon
History

Mon, 09 Nov 2026 18:30:00 +0000

Type Values Removed Values Added
Description SuperTokens Core is an open source authentication server. From 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, Multitenancy.checkPermissionsForCreateOrUpdate in src/main/java/io/supertokens/multitenancy/Multitenancy.java does not adequately authorize updates to a parent connection URI domain or the base tenant. In a licensed multi-tenant deployment with multiple applications under one non-default connection URI domain and separate api_keys, an attacker holding one application's valid API key can update the parent domain because the CUD-target branch checks the domain without requiring the source application and tenant to be public. Because api_keys is not protected, the attacker can replace the parent key and then sibling application keys, read or modify sibling users, obtain sessions as those users, establish persistence through a sibling dashboard user, and lock out the sibling application's own key. In the advisory's v2 create or update handlers, omitting the optional identifier produces a base-tenant target that skips the permission branches and enterprise-feature gate, allowing changes to firstFactors, required secondary factors, and recipe-enabled flags that affect login integrity and availability. The base-target variant still rejects coreConfig and does not establish key theft. This issue is fixed in versions 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Title SuperTokens Core: App-scoped API key can overwrite the parent connection URI domain's credentials and take over sibling applications
Weaknesses CWE-639
CWE-863
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-11-09T18:16:08.303Z

Reserved: 2026-11-06T15:27:56.225Z

Link: CVE-2026-123800

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key

  • CWE-863

    Incorrect Authorization