CVE-2026-123800

Name of the Vulnerable Software and Affected Versions SuperTokens Core versions 6.0.0 through 6.0.23 SuperTokens Core versions 7.0.0 through 7.0.22 SuperTokens Core versions 8.0.0 through 8.0.6 SuperTokens Core versions 9.0.0 through 9.0.5 SuperTokens Core versions 9.1.0 through 9.1.5 SuperTokens Core versions 9.2.0 through 9.2.6 SuperTokens Core versions 9.3.0 through 9.3.4 SuperTokens Core versions 10.0.0 through 10.0.7 SuperTokens Core versions 10.1.0 through 10.1.8 SuperTokens Core versions 11.0.0 through 11.0.8 SuperTokens Core versions 11.1.0 through 11.1.3 SuperTokens Core versions 11.2.0 through 11.2.3 SuperTokens Core versions 11.3.0 through 11.3.7 SuperTokens Core versions 11.4.0 through 11.4.7 SuperTokens Core versions 12.0.0 through 12.0.10 SuperTokens Core versions 12.1.0 through 12.1.1 SuperTokens Core versions 12.2.0 SuperTokens Core versions 12.3.0

Description An authorization flaw exists in the checkPermissionsForCreateOrUpdate() function within the Multitenancy class. In licensed multi-tenant deployments where multiple applications share a non-default connection URI domain and use separate api keys, an attacker with a valid API key for one application can update the parent connection URI domain. This occurs because the system fails to require the source application and tenant to be public when checking the domain during create or update operations. Consequently, an attacker can replace the parent key and sibling application keys, modify sibling users, hijack sessions, and establish persistence via sibling dashboard users. Additionally, omitting the optional identifier in v2 create or update handlers allows an attacker to target the base tenant, bypassing permission checks and enterprise-feature gates to modify firstFactors, required secondary factors, and recipe-enabled flags, which compromises login integrity and availability.

Recommendations Update to version 6.0.24 Update to version 7.0.23 Update to version 8.0.7 Update to version 9.0.6 Update to version 9.1.6 Update to version 9.2.7 Update to version 9.3.5 Update to version 10.0.8 Update to version 10.1.9 Update to version 11.0.9 Update to version 11.1.4 Update to version 11.2.4 Update to version 11.3.8 Update to version 11.4.8 Update to version 12.0.11 Update to version 12.1.2 Update to version 12.2.1 Update to version 12.3.1