CVE-2026-123797

Name of the Vulnerable Software and Affected Versions SuperTokens Core versions prior to 11.3.6 SuperTokens Core versions prior to 11.4.6 SuperTokens Core versions prior to 12.0.8

Description App-specific management requests using an unknown tenant path and an older supported cdi-version can bypass API-key and public-tenant enforcement. In the WebserverAPI.java file, the checkIPAccess() and assertThatAPIKeyCheckPasses() functions suppress TenantOrAppNotFoundException. Because the public-tenant guard only applies to CDI versions 5.0 and later, an unauthenticated caller can access the Core endpoint to create and enumerate application roles without a valid API key via the endpoints "PUT /ghosttenant/recipe/role" and "GET /ghosttenant/recipe/roles".

Recommendations Update to version 11.3.6. Update to version 11.4.6. Update to version 12.0.8.