Skip to content
OpenAdvisories

Vendor

supertokens

8 known vulnerabilities.

supertokens at a glance

Last 12 months
8
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 8 vulnerabilities, 1 critical
Show as table
MonthVulnerabilitiesCritical
Nov 202681
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

supertokens-core 8
All Critical High Medium Low Exploited only Public exploit

8 results · Feed

  • Medium 6.8
    CVE-2026-123804

    SuperTokens Core: A session created concurrently with account unlink survives the unlink

    SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert t…

    supertokens supertokens-core
  • High 8.1
    CVE-2026-123803

    SuperTokens Core: WebAuthn sign-in accepts a passkey across tenant boundaries

    SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform application-scoped WebAuthn …

    supertokens supertokens-core
  • High 8.1
    CVE-2026-123802

    SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, an…

    supertokens supertokens-core
  • High 7.4
    CVE-2026-123801

    SuperTokens Core: SAML callback accepts a replayed RelayState + SAMLResponse, minting a fresh authorization code on each replay

    SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseTo. In the SP-initiat…

    supertokens supertokens-core
  • Critical 9.9
    CVE-2026-123800

    SuperTokens Core is an open source authentication server. From 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, …

    supertokens supertokens-core
  • High 7.4
    CVE-2026-123799

    SuperTokens Core: Dashboard session tokens are never checked for expiry: `isValidUserSession` ignores the stored `expiry`, so a long-expired admin session still authenticates

    SuperTokens Core is an open source authentication server. From 11.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, and 12.1.2, Dashboard.isValidUserSession treats any stored session row as valid without comparing DashboardSessionInfo.expiry to the c…

    supertokens supertokens-core
  • High 8.1
    CVE-2026-123798

    SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.7, 11.4.7, and 12.0.10, SAML.verifySam…

    supertokens supertokens-core
  • High 7.5
    CVE-2026-123797

    SuperTokens Core: Unknown tenant path bypasses API key and public-tenant enforcement

    SuperTokens Core is an open source authentication server. Prior to 11.3.6, 11.4.6, and 12.0.8, app-specific management requests using an unknown tenant path and an older supported cdi-version can bypass API-key and public-tenant enforcement. In src/main/java/…

    supertokens supertokens-core