{"api_version":"1","generated_at":"2026-11-10T11:48:18+00:00","cve":"CVE-2026-123801","urls":{"html":"https://cve.report/CVE-2026-123801","api":"https://cve.report/api/cve/CVE-2026-123801.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-123801","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-123801"},"summary":{"title":"SuperTokens Core: SAML callback accepts a replayed RelayState + SAMLResponse, minting a fresh authorization code on each replay","description":"SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseTo. In the SP-initiated flow, an attacker who obtains a legitimately issued, still-valid SAML response and its matching RelayState can resubmit the pair to /recipe/saml/callback before the assertion's NotOnOrAfter time; in the IdP-initiated flow, the assertion can be replayed without RelayState. The missing Response.InResponseTo check also permits an in-progress login to be completed with an assertion for a different identity and fails to enforce allowIDPInitiatedLogin=false. The callback does not validate Destination or SubjectConfirmationData Recipient and NotOnOrAfter, and each accepted callback mints a fresh, independently redeemable authorization code carrying the captured user's identity. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.","state":"PUBLISHED","assigner":"GitHub_M","published_at":"2026-11-09 19:16:46","updated_at":"2026-11-09 19:16:46"},"problem_types":["CWE-294","CWE-346","CWE-384","CWE-294 CWE-294: Authentication Bypass by Capture-replay","CWE-346 CWE-346: Origin Validation Error","CWE-384 CWE-384: Session Fixation"],"metrics":[{"version":"3.1","source":"security-advisories@github.com","type":"Secondary","score":"7.4","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.4","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","data":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}}],"references":[{"url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1","name":"https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/supertokens/supertokens-core/security/advisories/GHSA-3r7x-rhvc-fw28","name":"https://github.com/supertokens/supertokens-core/security/advisories/GHSA-3r7x-rhvc-fw28","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1","name":"https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11","name":"https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/supertokens/supertokens-core/commit/ca2bca9bc900c2fd399d508818ad026cc977dcf6","name":"https://github.com/supertokens/supertokens-core/commit/ca2bca9bc900c2fd399d508818ad026cc977dcf6","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/supertokens/supertokens-core/commit/075655222f5e72f3683a127e45c83c4174fbd4f7","name":"https://github.com/supertokens/supertokens-core/commit/075655222f5e72f3683a127e45c83c4174fbd4f7","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/supertokens/supertokens-core/commit/5c42f02e98f67174c6a5a800dd9f8bd5b6e98486","name":"https://github.com/supertokens/supertokens-core/commit/5c42f02e98f67174c6a5a800dd9f8bd5b6e98486","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/supertokens/supertokens-core/commit/557835406547d269f5d0e33159630a1873461c38","name":"https://github.com/supertokens/supertokens-core/commit/557835406547d269f5d0e33159630a1873461c38","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8","name":"https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8","name":"https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/supertokens/supertokens-core/commit/4e05d8cf60287e9d2720140031a8b8f4430d056f","name":"https://github.com/supertokens/supertokens-core/commit/4e05d8cf60287e9d2720140031a8b8f4430d056f","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2","name":"https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/supertokens/supertokens-core/commit/b6730e608b2d4562939cd4f41ea07df5f841dfe5","name":"https://github.com/supertokens/supertokens-core/commit/b6730e608b2d4562939cd4f41ea07df5f841dfe5","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-123801","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123801","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"supertokens","product":"supertokens-core","version":"affected >= 11.3.0, < 11.3.8","platforms":[]},{"source":"CNA","vendor":"supertokens","product":"supertokens-core","version":"affected >= 11.4.0, < 11.4.8","platforms":[]},{"source":"CNA","vendor":"supertokens","product":"supertokens-core","version":"affected >= 12.0.0, < 12.0.11","platforms":[]},{"source":"CNA","vendor":"supertokens","product":"supertokens-core","version":"affected >= 12.1.0, < 12.1.2","platforms":[]},{"source":"CNA","vendor":"supertokens","product":"supertokens-core","version":"affected >= 12.2.0, < 12.2.1","platforms":[]},{"source":"CNA","vendor":"supertokens","product":"supertokens-core","version":"affected >= 12.3.0, < 12.3.1","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"product":"supertokens-core","vendor":"supertokens","versions":[{"status":"affected","version":">= 11.3.0, < 11.3.8"},{"status":"affected","version":">= 11.4.0, < 11.4.8"},{"status":"affected","version":">= 12.0.0, < 12.0.11"},{"status":"affected","version":">= 12.1.0, < 12.1.2"},{"status":"affected","version":">= 12.2.0, < 12.2.1"},{"status":"affected","version":">= 12.3.0, < 12.3.1"}]}],"descriptions":[{"lang":"en","value":"SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseTo. In the SP-initiated flow, an attacker who obtains a legitimately issued, still-valid SAML response and its matching RelayState can resubmit the pair to /recipe/saml/callback before the assertion's NotOnOrAfter time; in the IdP-initiated flow, the assertion can be replayed without RelayState. The missing Response.InResponseTo check also permits an in-progress login to be completed with an assertion for a different identity and fails to enforce allowIDPInitiatedLogin=false. The callback does not validate Destination or SubjectConfirmationData Recipient and NotOnOrAfter, and each accepted callback mints a fresh, independently redeemable authorization code carrying the captured user's identity. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1."}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-294","description":"CWE-294: Authentication Bypass by Capture-replay","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-346","description":"CWE-346: Origin Validation Error","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-384","description":"CWE-384: Session Fixation","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-09T18:18:47.322Z","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M"},"references":[{"name":"https://github.com/supertokens/supertokens-core/security/advisories/GHSA-3r7x-rhvc-fw28","tags":["x_refsource_CONFIRM"],"url":"https://github.com/supertokens/supertokens-core/security/advisories/GHSA-3r7x-rhvc-fw28"},{"name":"https://github.com/supertokens/supertokens-core/commit/075655222f5e72f3683a127e45c83c4174fbd4f7","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/commit/075655222f5e72f3683a127e45c83c4174fbd4f7"},{"name":"https://github.com/supertokens/supertokens-core/commit/4e05d8cf60287e9d2720140031a8b8f4430d056f","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/commit/4e05d8cf60287e9d2720140031a8b8f4430d056f"},{"name":"https://github.com/supertokens/supertokens-core/commit/557835406547d269f5d0e33159630a1873461c38","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/commit/557835406547d269f5d0e33159630a1873461c38"},{"name":"https://github.com/supertokens/supertokens-core/commit/5c42f02e98f67174c6a5a800dd9f8bd5b6e98486","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/commit/5c42f02e98f67174c6a5a800dd9f8bd5b6e98486"},{"name":"https://github.com/supertokens/supertokens-core/commit/b6730e608b2d4562939cd4f41ea07df5f841dfe5","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/commit/b6730e608b2d4562939cd4f41ea07df5f841dfe5"},{"name":"https://github.com/supertokens/supertokens-core/commit/ca2bca9bc900c2fd399d508818ad026cc977dcf6","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/commit/ca2bca9bc900c2fd399d508818ad026cc977dcf6"},{"name":"https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8"},{"name":"https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8"},{"name":"https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11"},{"name":"https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2"},{"name":"https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1"},{"name":"https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1"}],"source":{"advisory":"GHSA-3r7x-rhvc-fw28","discovery":"UNKNOWN"},"title":"SuperTokens Core: SAML callback accepts a replayed RelayState + SAMLResponse, minting a fresh authorization code on each replay"}},"cveMetadata":{"assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","assignerShortName":"GitHub_M","cveId":"CVE-2026-123801","datePublished":"2026-11-09T18:18:47.322Z","dateReserved":"2026-11-06T15:27:56.226Z","dateUpdated":"2026-11-09T18:18:47.322Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-09 19:16:46","lastModifiedDate":"2026-11-09 19:16:46","problem_types":["CWE-294","CWE-346","CWE-384","CWE-294 CWE-294: Authentication Bypass by Capture-replay","CWE-346 CWE-346: Origin Validation Error","CWE-384 CWE-384: Session Fixation"],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"123801","Ordinal":"1","Title":"SuperTokens Core: SAML callback accepts a replayed RelayState + ","CVE":"CVE-2026-123801","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"123801","Ordinal":"1","NoteData":"SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseTo. In the SP-initiated flow, an attacker who obtains a legitimately issued, still-valid SAML response and its matching RelayState can resubmit the pair to /recipe/saml/callback before the assertion's NotOnOrAfter time; in the IdP-initiated flow, the assertion can be replayed without RelayState. The missing Response.InResponseTo check also permits an in-progress login to be completed with an assertion for a different identity and fails to enforce allowIDPInitiatedLogin=false. The callback does not validate Destination or SubjectConfirmationData Recipient and NotOnOrAfter, and each accepted callback mints a fresh, independently redeemable authorization code carrying the captured user's identity. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.","Type":"Description","Title":"SuperTokens Core: SAML callback accepts a replayed RelayState + "}]}}}