CVE-2026-123801

Name of the Vulnerable Software and Affected Versions SuperTokens Core versions 11.3.0 through 11.3.7 SuperTokens Core versions 11.4.0 through 11.4.7 SuperTokens Core versions 12.0.0 through 12.0.10 SuperTokens Core versions 12.1.0 through 12.1.1 SuperTokens Core versions 12.2.0 SuperTokens Core versions 12.3.0

Description An issue exists in the SAML.handleCallback() function where it fails to consume RelayState, record assertion identifiers, or enforce Response.InResponseTo. In Service Provider (SP)-initiated flows, an attacker with a valid SAML response and matching RelayState can resubmit them to the /recipe/saml/callback endpoint before the assertion expires. In Identity Provider (IdP)-initiated flows, assertions can be replayed without RelayState. Additionally, the lack of Response.InResponseTo checks allows an active login to be completed using an assertion for a different identity and bypasses the allowIDPInitiatedLogin=false setting. The callback also fails to validate Destination or SubjectConfirmationData Recipient and NotOnOrAfter, resulting in the creation of a new authorization code for the captured user's identity.

Recommendations Update to version 11.3.8 Update to version 11.4.8 Update to version 12.0.11 Update to version 12.1.2 Update to version 12.2.1 Update to version 12.3.1