CVE-2026-123799SuperTokens Core: Dashboard session tokens are never checked for expiry: `isValidUserSession` ignores the stored `expiry`, so a long-expired admin session still authenticates
- 7.4HighCVSS base score
- 0.78%Exploitation in 30 daysEPSS · top 44% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
SuperTokens Core is an open source authentication server. From 11.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, and 12.1.2, Dashboard.isValidUserSession treats any stored session row as valid without comparing DashboardSessionInfo.expiry to the current time. DashboardQueries.getSessionInfoWithSessionId also selects by app and session identifier without an expiry predicate, leaving the periodic DeleteExpiredDashboardSessions cleanup as the only expiration enforcement. An attacker who obtains a dashboard administrator session after its 30-day lifetime can continue using POST /recipe/dashboard/session/verify until the row is removed, and frequent Core restarts can prevent the 12-hour cleanup sweep from running. The stale session retains full dashboard read and write access, but the flaw does not provide a way to guess or acquire the random session identifier. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, and 12.1.2.
Timeline
ID reserved
By GitHub_M
- 3 days later
· 3 days later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| NVDNVD · Deferred | 3.1 | High7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
- EPSS (exploitation in 30 days)
- 0.78% · top 44% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.4.
Affected products
supertokens · supertokens-core
- affected >= 11.0.0, < 11.0.9
- affected >= 11.1.0, < 11.1.4
- affected >= 11.2.0, < 11.2.4
- affected >= 11.3.0, < 11.3.8
- affected >= 11.4.0, < 11.4.8
- affected >= 12.0.0, < 12.0.11
- affected >= 12.1.0, < 12.1.2
References
References17
- https://github.com/supertokens/supertokens-core/security/advisories/GHSA-w9fp-wv6g-pqv8 (opens in a new tab)x_refsource_CONFIRM
- https://github.com/supertokens/supertokens-core/pull/1409 (opens in a new tab)x_refsource_MISC
- https://github.com/supertokens/supertokens-core/commit/0f4817152278b39fbf21b97c3795b4fc68c12c38 (opens in a new tab)x_refsource_MISC
- https://github.com/supertokens/supertokens-core/commit/4b315b2382c8eec2cde28fbda113597bffad8da5 (opens in a new tab)x_refsource_MISC
- https://github.com/supertokens/supertokens-core/commit/699d806b5fc77ee6343f8e48e0769dce8049b078 (opens in a new tab)x_refsource_MISC
- https://github.com/supertokens/supertokens-core/commit/8906b840669b28b3af7367cf18870db0044d0d18 (opens in a new tab)x_refsource_MISC
- https://github.com/supertokens/supertokens-core/commit/bd8eb93001cf814a8065e8f3cea755af267bc308 (opens in a new tab)x_refsource_MISC
- https://github.com/supertokens/supertokens-core/commit/ced1c913d53641e5eb8108caef110e55348b5401 (opens in a new tab)x_refsource_MISC
- https://github.com/supertokens/supertokens-core/commit/da0ec91d20ecbb68730741f8b0dec8c986b68877 (opens in a new tab)x_refsource_MISC
- https://github.com/supertokens/supertokens-core/commit/e72793ec5bd925fd3b9ff19328043dc2a03201bd (opens in a new tab)x_refsource_MISC
- https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9 (opens in a new tab)x_refsource_MISC
- https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4 (opens in a new tab)x_refsource_MISC
- https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4 (opens in a new tab)x_refsource_MISC
- https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8 (opens in a new tab)x_refsource_MISC
- https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8 (opens in a new tab)x_refsource_MISC
- https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11 (opens in a new tab)x_refsource_MISC
- https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-120163 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-123799)Record last updated .