Tenant Separation Bypass in SuperTokens Core

Executive Summary

CVE-2026-37171 is a cross-tenant session trust flaw in SuperTokens Core versions 6.0.0 to 11.4.0. The system fails to validate the tenant context of a session token against the request's tenant path. A session token issued for one tenant is accepted by another tenant's endpoint, allowing unauthorized access to cross-tenant data and operations.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check SuperTokens Core versions between 6.0.0 and 11.4.0. Verify if tenant isolation is enforced by testing cross-tenant session token acceptance. Commands include checking version with 'supertokens --version' and inspecting JWT tokens for tenant claims.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables scenarios like cross-tenant session verification, data exfiltration, and JWT claim injection. Attackers can read another tenant's session data, inject malicious claims, hijack accounts, or consume password-reset tokens across tenants. It undermines tenant isolation in B2B SaaS deployments.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability undermines data isolation required by GDPR and HIPAA. It allows unauthorized access to tenant-specific data, potentially violating confidentiality and integrity requirements. Compliance with these regulations may be compromised due to the lack of tenant separation.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SuperTokens Core to a patched version beyond 11.4.0. Validate token tenant claims against request context. Avoid relying solely on API-key authentication as a fix. Contact vendor for remediation guidance.

Useful 0 Not Useful 0