CVE-2026-123798

Name of the Vulnerable Software and Affected Versions SuperTokens Core versions 11.3.0 through 11.3.6 SuperTokens Core versions 11.4.0 through 11.4.6 SuperTokens Core versions 12.0.0 through 12.0.9

Description An issue exists where the SAML.verifySamlResponseSignature function calls OpenSAML SignatureValidator.validate without first applying SAMLSignatureProfileValidator. This allows the system to accept a cryptographically valid signature that references an XML element different from the Response or Assertion used for authentication. An attacker can move a signed element within the document and provide a malicious identity-bearing element, leading to XML Signature Wrapping, which enables authentication as another identity provider user. This affects both response-level and assertion-level signing paths, and remains reachable during SP-initiated login even if allowIDPInitiatedLogin is disabled.

Recommendations Update to version 11.3.7. Update to version 11.4.7. Update to version 12.0.10.