Skip to content
CVE-2026-123800: SuperTokens API Key Bypass Vulnerability

CVE-2026-123800: SuperTokens API Key Bypass Vulnerability

First seen 10 Nov 2026, 19:51 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 10, 2026 at 19:52 UTC
  • •CVE-2026-123800 allows API key overwriting across sibling applications.
  • •The vulnerability has a critical CVSS score of 9.9 and was disclosed on November 9, 2026.
  • •Patches were released on October 16, 2026, and organizations are urged to update immediately.

CVE-2026-123800 is a vulnerability in SuperTokens Core that allows an API key from one application to overwrite the parent connection URI domain's configuration, affecting sibling applications. This flaw arises from a permission check that fails to validate the caller's application identity, enabling an attacker to escalate privileges across applications. The vulnerability was disclosed on November 9, 2026, with a CVSS score of 9.9, indicating its severity. The maintainers released patches for the issue across 18 release branches on October 16, 2026. Attackers can exploit this flaw to read and modify user data across sibling applications, effectively locking out the original application from its own API key. The vulnerability is currently listed in the CISA KEV catalog, but exploitation in the wild has not been confirmed. Organizations using SuperTokens Core are advised to apply the patches immediately to mitigate the risk.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 2h ago How this analysis works

Timeline

2026-10-16
Patches released
SuperTokens maintainers fixed the vulnerability across 18 release branches.
Brandefense
2026-11-09
CVE-2026-123800 published
CVE-2026-123800 disclosed with a CVSS score of 9.9, highlighting a critical API key bypass vulnerability.
Brandefense

More articles in this cluster (4)

Following this threat?

Track CVE-2026-123800 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (1)

1 / 2

Common questions

Which versions of SuperTokens are affected?
All versions of SuperTokens Core that support multi-tenancy are affected by this vulnerability.
What should I do if I use SuperTokens?
Immediately apply the patches released on October 16, 2026, to secure your deployment.
Is there evidence of active exploitation?
No confirmed active exploitation has been reported at this time, but the vulnerability is critical.