SuperTokens Core: App-scoped API key can overwrite the parent connection URI domain's credentials and take over sibling applications
Summary
| CVE | CVE-2026-123800 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-09 19:16:46 UTC |
| Updated | 2026-11-09 19:16:46 UTC |
| Description | SuperTokens Core is an open source authentication server. From 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, Multitenancy.checkPermissionsForCreateOrUpdate in src/main/java/io/supertokens/multitenancy/Multitenancy.java does not adequately authorize updates to a parent connection URI domain or the base tenant. In a licensed multi-tenant deployment with multiple applications under one non-default connection URI domain and separate api_keys, an attacker holding one application's valid API key can update the parent domain because the CUD-target branch checks the domain without requiring the source application and tenant to be public. Because api_keys is not protected, the attacker can replace the parent key and then sibling application keys, read or modify sibling users, obtain sessions as those users, establish persistence through a sibling dashboard user, and lock out the sibling application's own key. In the advisory's v2 create or update handlers, omitting the optional identifier produces a base-tenant target that skips the permission branches and enterprise-feature gate, allowing changes to firstFactors, required secondary factors, and recipe-enabled flags that affect login integrity and availability. The base-target variant still rejects coreConfig and does not establish key theft. This issue is fixed in versions 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1. |
Risk And Classification
Primary CVSS: v3.1 9.9 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Problem Types: CWE-639 | CWE-863 | CWE-639 CWE-639: Authorization Bypass Through User-Controlled Key | CWE-863 CWE-863: Incorrect Authorization
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 9.9 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| 3.1 | CNA | DECLARED | 9.9 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
ChangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Supertokens | Supertokens-core | affected >= 6.0.0, < 6.0.24 | Not specified |
| CNA | Supertokens | Supertokens-core | affected >= 7.0.0, < 7.0.23 | Not specified |
| CNA | Supertokens | Supertokens-core | affected >= 8.0.0, < 8.0.7 | Not specified |
| CNA | Supertokens | Supertokens-core | affected >= 9.0.0, < 9.0.6 | Not specified |
| CNA | Supertokens | Supertokens-core | affected >= 9.1.0, < 9.1.6 | Not specified |
| CNA | Supertokens | Supertokens-core | affected >= 9.2.0, < 9.2.7 | Not specified |
| CNA | Supertokens | Supertokens-core | affected >= 9.3.0, < 9.3.5 | Not specified |
| CNA | Supertokens | Supertokens-core | affected >= 10.0.0, < 10.0.8 | Not specified |
| CNA | Supertokens | Supertokens-core | affected >= 10.1.0, < 10.1.9 | Not specified |
| CNA | Supertokens | Supertokens-core | affected >= 11.0.0, < 11.0.9 | Not specified |
| CNA | Supertokens | Supertokens-core | affected >= 11.1.0, < 11.1.4 | Not specified |
| CNA | Supertokens | Supertokens-core | affected >= 11.2.0, < 11.2.4 | Not specified |
| CNA | Supertokens | Supertokens-core | affected >= 11.3.0, < 11.3.8 | Not specified |
| CNA | Supertokens | Supertokens-core | affected >= 11.4.0, < 11.4.8 | Not specified |
| CNA | Supertokens | Supertokens-core | affected >= 12.0.0, < 12.0.11 | Not specified |
| CNA | Supertokens | Supertokens-core | affected >= 12.1.0, < 12.1.2 | Not specified |
| CNA | Supertokens | Supertokens-core | affected >= 12.2.0, < 12.2.1 | Not specified |
| CNA | Supertokens | Supertokens-core | affected >= 12.3.0, < 12.3.1 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/supertokens/supertokens-core/releases/tag/v12.2.1 | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/commit/a186f1013c784de8a796a732e... | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/releases/tag/v6.0.24 | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/releases/tag/v12.3.1 | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/commit/ff9ca3ec53861a91996c4e958... | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/releases/tag/v9.0.6 | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/releases/tag/v12.0.11 | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/releases/tag/v9.3.5 | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/commit/df79f3b4399ef31aea4cb44cc... | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/commit/1d9dcb03ce0691d9b8abee48f... | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/commit/64dfa92c50a2ec288fe787ee5... | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/releases/tag/v8.0.7 | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/releases/tag/v7.0.23 | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/releases/tag/v11.0.9 | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/releases/tag/v11.1.4 | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/commit/61bfd3ebde1cf4b092da85ee8... | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/releases/tag/v11.2.4 | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/releases/tag/v10.0.8 | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/commit/8db9b0c39f97f240e11682143... | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/commit/e616f4002c31d256f9ff6cb3d... | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/commit/bf6184f027a99bd1b3b1df3d2... | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/commit/337bb3eba812a5ee52d578547... | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/commit/4d1ef0e177681f4f74995e4a2... | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/commit/13c3de170dd40dd217db0f6bd... | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/commit/8e48ef856becbaaeb50ad4c91... | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/security/advisories/GHSA-4rf2-xq... | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/releases/tag/v11.4.8 | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/commit/c6d7dc7d73b9bb3075b3f7a1a... | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/releases/tag/v10.1.9 | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/releases/tag/v11.3.8 | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/releases/tag/v9.2.7 | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/releases/tag/v9.1.6 | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/commit/4902b713f31306ca41148070d... | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/commit/9b0d3a9fdbdcb48dd7dd9d520... | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/commit/1cc02b971f064c2fa2d9bc74b... | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/commit/b58bc3d03549d20495df71c03... | [email protected] | github.com | |
| github.com/supertokens/supertokens-core/releases/tag/v12.1.2 | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.