CVE-2026-123799

Name of the Vulnerable Software and Affected Versions SuperTokens Core versions 11.0.0 through 11.0.8 SuperTokens Core versions 11.1.0 through 11.1.3 SuperTokens Core versions 11.2.0 through 11.2.3 SuperTokens Core versions 11.3.0 through 11.3.7 SuperTokens Core versions 11.4.0 through 11.4.7 SuperTokens Core versions 12.0.0 through 12.0.10 SuperTokens Core versions 12.1.0 through 12.1.1

Description The isValidUserSession function in the Dashboard treats any stored session row as valid because it fails to compare DashboardSessionInfo.expiry to the current time. Additionally, the getSessionInfoWithSessionId function selects data by app and session identifier without an expiry predicate, relying solely on the DeleteExpiredDashboardSessions cleanup process for expiration enforcement. An attacker possessing a dashboard administrator session can continue using the 'POST /recipe/dashboard/session/verify' endpoint after the 30-day lifetime has expired, provided the session row has not been removed. Frequent restarts of the Core can prevent the 12-hour cleanup sweep from executing, allowing the stale session to maintain full read and write access to the dashboard. This issue does not allow for the guessing or acquisition of the random session identifier.

Recommendations Update to version 11.0.9 Update to version 11.1.4 Update to version 11.2.4 Update to version 11.3.8 Update to version 11.4.8 Update to version 12.0.11 Update to version 12.1.2