CVE-2026-123803
Received Received - Intake

Authentication Bypass via WebAuthn in SuperTokens Core

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: GitHub, Inc.

Description
SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform application-scoped WebAuthn lookups without constraining them to the requested tenant, and WebAuthN.signIn does not verify tenant membership. In a multi-tenant deployment using WebAuthn with a shared user pool, an ordinary user who possesses their own valid passkey in one tenant can submit its assertion to another tenant's sign-in endpoint in the same application and be authenticated there despite having no membership in the target tenant. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-123803
EUVD
EUVD-2026-120228

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
supertokens core From 10.1.0 (inc) to 11.0.9 (inc)
supertokens core 11.0.9
supertokens core 11.1.4
supertokens core 11.2.4
supertokens core 11.3.8
supertokens core 11.4.8
supertokens core 12.0.11
supertokens core 12.1.2
supertokens core 12.2.1
supertokens core 12.3.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-1220 The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects SuperTokens Core, an open-source authentication server. It allows users to authenticate in a different tenant's account without proper membership due to improper WebAuthn lookup constraints in multi-tenant deployments.

Impact Analysis

In a multi-tenant setup using WebAuthn with shared users, an attacker with a valid passkey in one tenant could access another tenant's account without authorization, leading to unauthorized access and potential data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA, potentially resulting in legal penalties and loss of trust.

Mitigation Strategies

Upgrade SuperTokens Core to a patched version (11.0.9 or later, 11.1.4 or later, 11.2.4 or later, 11.3.8 or later, 11.4.8 or later, 12.0.11 or later, 12.1.2 or later, 12.2.1 or later, 12.3.1 or later) to fix the tenant isolation issue in WebAuthn authentication.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123803. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...