CVE-2026-123800: SuperTokens Core Auth Bypass (CVSS 9.9)

In a licensed multi-tenant deployment, a permission check skips a required identity test for one request shape. An application's own API key can then rewrite the shared connection-URI-domain's configuration above it, including that domain's own API keys. The maintainers fixed the issue across 18 release branches on 16 October 2026.

SuperTokens Core is an open-source authentication server. A licensed deployment can run multitenancy, where several applications sit under one connection URI domain (CUD) and each application keeps its own API key. The advisory says the server must confirm a caller's application and tenant before it accepts a change to that shared domain's own configuration.

The advisory's root-cause section names the function Multitenancy.checkPermissionsForCreateOrUpdate, in src/main/java/io/supertokens/multitenancy/Multitenancy.java. Per the advisory, the branch that checks a CUD-level target accepts a caller whose own connection-URI-domain string matches the target.

It does not also require that caller to be the domain's base tenant and public application, unlike the neighboring tenant-level and application-level branches. The advisory adds that api_keys is not on the list of protected configuration fields, so a request that passes the weaker branch can carry a replacement key.

What an Attacker Gains

The advisory describes a two-hop privilege escalation . First, an application's own API key rewrites the shared domain's api_keys, which hands the caller the domain's own public application. Second, acting as that public application, the same method rewrites a sibling application's api_keys.

The advisory says the attacker can then read and change the sibling's users, and have the core issue sessions for any of them. It adds that the attacker can plant a persistent dashboard user, while the sibling's original key stops working.

The advisory names a second, narrower path. Per the advisory, the create-or-update handlers treat an omitted identifier as a request aimed at the base tenant. The same three permission branches all evaluate as false there, skipping the check entirely for that shape. The advisory says this path cannot carry a new API key, so it reaches fields such as firstFactors and the enterprise-feature gate instead.

GitHub, the CNA, scores CVE-2026-123800 at CVSS 3.1 9.9, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. NVD lists the same score and vector as a secondary source; its own entry shows status Received, meaning NVD has not yet published an independent score.

There is no CVSS 4.0 score in the record or NVD. The advisory lists Scope as Changed because the impact of one application's own key reaches a different application's data. See our CVSS entry for how to read the vector. The advisory credits five reporters for the two variants: GrayOM, Judel777, Winfunc Research (mufeedvh and 123vivekr), Feldspar-AI-Agent and hhh0710.

What the Maintainers and CISA KEV Say

The advisory's own Patches field still reads "Pending." GitHub's release records show the fix shipped the same day the advisory was published: all 18 patched versions, from 6.0.24 through 12.3.1, carry a published timestamp of 16 October 2026. The 12.3.1 release notes name GHSA-4rf2-xqvf-8rcx directly as a fix in that build. We read the advisory's wording as describing the fix design, not the release state.

As of CISA catalog version 2026.11.09, the CVE is not in the Known Exploited Vulnerabilities catalog. No public report of exploitation found as of 9 November 2026. Our KEV glossary entry explains the catalog.

The CVE record and the GitHub advisory both list the same 18 affected release branches of SuperTokens Core, each with its own fixed point release. The ranges below are the vendor's own open-ended notation; we have not filled in an assumed last affected build for each branch.

The advisory limits the precondition to licensed multi-tenant deployments that place more than one application under one connection URI domain, each with its own API key. A single-tenant deployment, or a multi-tenant one where every application sits under its own domain, does not meet that precondition. The advisory says it reproduced the issue on a published 12.2.0 PostgreSQL image, and that the vulnerable branch has been present since version 10.0.0.

The advisory's own Workarounds field says none exist at the configuration level for an affected deployment shape. We recommend upgrading the core to the fixed point release on your branch. We also recommend rotating every API key under the affected connection URI domain afterward, since the flaw's own impact is key theft.

16 Oct 2026 The maintainers publish GHSA-4rf2-xqvf-8rcx. GitHub's release records show all 18 patched point releases, from 6.0.24 through 12.3.1, published the same day.

The maintainers publish GHSA-4rf2-xqvf-8rcx. GitHub's release records show all 18 patched point releases, from 6.0.24 through 12.3.1, published the same day.

6 Nov 2026 GitHub, as CNA, reserves CVE-2026-123800, per the CVE record.

GitHub, as CNA, reserves CVE-2026-123800, per the CVE record.

9 Nov 2026 GitHub publishes the formal CVE record, and NVD lists its entry.

GitHub publishes the formal CVE record, and NVD lists its entry.

Find Licensed Multi-Tenant Deployments List every SuperTokens Core deployment under license. Note which ones place more than one application under a single connection URI domain with separate API keys; the advisory limits the issue to that shape.

Find Licensed Multi-Tenant Deployments

List every SuperTokens Core deployment under license. Note which ones place more than one application under a single connection URI domain with separate API keys; the advisory limits the issue to that shape.

Upgrade to Your Branch's Fixed Release Move each deployment to the fixed point release for its branch, as the advisory and the CVE record list them. The advisory gives no interim configuration workaround.

Upgrade to Your Branch's Fixed Release

Move each deployment to the fixed point release for its branch, as the advisory and the CVE record list them. The advisory gives no interim configuration workaround.

Rotate API Keys After Upgrading We recommend rotating every API key under an affected connection URI domain once you upgrade, since the flaw itself is a path to reading and replacing those keys.

Rotate API Keys After Upgrading

We recommend rotating every API key under an affected connection URI domain once you upgrade, since the flaw itself is a path to reading and replacing those keys.

Review Sibling Applications for an Unexpected Dashboard User The advisory describes a dashboard user as the attacker's route to staying logged in after the core rejects the stolen key. We recommend checking every application under an affected domain for a dashboard account you did not create.

Review Sibling Applications for an Unexpected Dashboard User

The advisory describes a dashboard user as the attacker's route to staying logged in after the core rejects the stolen key. We recommend checking every application under an affected domain for a dashboard account you did not create.

Review Session and User Activity on Sibling Applications We recommend checking sign-in history and session lists on applications that shared a connection URI domain with an affected one. The advisory describes the core issuing sessions for a sibling application's own users.

Review Session and User Activity on Sibling Applications

We recommend checking sign-in history and session lists on applications that shared a connection URI domain with an affected one. The advisory describes the core issuing sessions for a sibling application's own users.

What Brandefense can do

Scan your domain in Brandefense Atlas, free → Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.

Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.

Vulnerability Intelligence → Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.

Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.

Frequently Asked Questions

The CVE record and the GitHub advisory list 18 release branches, 6.0.x through 12.3.x, each affected from its first release up to its own fixed point release.

No. The advisory limits it to licensed multi-tenant deployments that place more than one application under one connection URI domain, each with its own API key.

The advisory's Workarounds field says none exist at the configuration level for the affected deployment shape; upgrading to the fixed point release is the stated fix.

We read that as the advisory text not catching up to the release. GitHub's own release records show all 18 fixed versions published on 16 October 2026, and the 12.3.1 release notes name this advisory directly.

It is not in catalog version 2026.11.09. No public report of exploitation found as of 9 November 2026.

CVE-2026-123800 Record CVE Program / GitHub CNA

GHSA-4rf2-xqvf-8rcx, App-scoped API key can overwrite the parent connection URI domain's credentials and take over sibling applications SuperTokens Core on GitHub

SuperTokens Core 12.3.1 release notes SuperTokens Core on GitHub

Known Exploited Vulnerabilities Catalog CISA