Description
SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform application-scoped WebAuthn lookups without constraining them to the requested tenant, and WebAuthN.signIn does not verify tenant membership. In a multi-tenant deployment using WebAuthn with a shared user pool, an ordinary user who possesses their own valid passkey in one tenant can submit its assertion to another tenant's sign-in endpoint in the same application and be authenticated there despite having no membership in the target tenant. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Published: 2026-11-09
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://github.com/supertokens/supertokens-core/commit/01ca34a06baa0d22db008f38c8eabd1f6695d9a6 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/030643edea5d69e0009ceeecbc5dd70be5c66186 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/1e3e4d9b25237a9c8fd77cbe0d4d0ecb360d8cd6 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/84492e38f9eb6db0cc338674ce5e94d1603bef08 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/982d420a5ac29d5e362eaf39169a7a9f5339abeb cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/a3d033022effb00ccf0c4ec6ca77c36eb1a24617 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/ad768c1925e245930e5fbf9441452d85564de91d cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/b933b6c9b4495e47a8b3efeb5a70e9d014777320 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/e19d173f47658d036685d3020e18819c5f3690b7 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/security/advisories/GHSA-6v34-w48w-44rc cve-icon cve-icon
History

Wed, 11 Nov 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Supertokens
Supertokens supertokens
Vendors & Products Supertokens
Supertokens supertokens

Mon, 09 Nov 2026 19:00:00 +0000

Type Values Removed Values Added
Description SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform application-scoped WebAuthn lookups without constraining them to the requested tenant, and WebAuthN.signIn does not verify tenant membership. In a multi-tenant deployment using WebAuthn with a shared user pool, an ordinary user who possesses their own valid passkey in one tenant can submit its assertion to another tenant's sign-in endpoint in the same application and be authenticated there despite having no membership in the target tenant. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Title SuperTokens Core: WebAuthn sign-in accepts a passkey across tenant boundaries
Weaknesses CWE-1220
CWE-863
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Supertokens Supertokens
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-11-09T23:01:11.131Z

Reserved: 2026-11-06T15:27:56.226Z

Link: CVE-2026-123803

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-09T19:16:47.273

Modified: 2026-11-09T23:17:16.690

Link: CVE-2026-123803

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-11T15:45:21Z

Weaknesses