supertokens vulnerabilities
8 published CVEs name supertokens among the affected products.
- 8Published CVEs8 of them scored
- 8Last 12 monthspublished in the last year
- 1Critical6 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-123804
SuperTokens Core: A session created concurrently with account unlink survives the unlink
supertokens · supertokens-core
Medium6.8 - CVE-2026-123803
SuperTokens Core: WebAuthn sign-in accepts a passkey across tenant boundaries
supertokens · supertokens-core
High8.1 - CVE-2026-123802
SuperTokens Core SAML: identity taken from an assertion that never passed the audience check, allowing sign-in as any IdP user
supertokens · supertokens-core
High8.1 - CVE-2026-123801
SuperTokens Core: SAML callback accepts a replayed RelayState + SAMLResponse, minting a fresh authorization code on each replay
supertokens · supertokens-core
High7.4 - CVE-2026-123800
SuperTokens Core: App-scoped API key can overwrite the parent connection URI domain's credentials and take over sibling applications
supertokens · supertokens-core
Critical9.9 - CVE-2026-123799
SuperTokens Core: Dashboard session tokens are never checked for expiry: `isValidUserSession` ignores the stored `expiry`, so a long-expired admin session still authenticates
supertokens · supertokens-core
High7.4 - CVE-2026-123798
SuperTokens Core: SAML XML Signature Wrapping authentication bypass — any IdP user can authenticate as any other user
supertokens · supertokens-core
High8.1 - CVE-2026-123797
SuperTokens Core: Unknown tenant path bypasses API key and public-tenant enforcement
supertokens · supertokens-core
High7.5