CVE-2026-123802

Name of the Vulnerable Software and Affected Versions SuperTokens Core versions 11.3.0 through 11.3.7 SuperTokens Core versions 11.4.0 through 11.4.7 SuperTokens Core versions 12.0.0 through 12.0.10 SuperTokens Core versions 12.1.0 through 12.1.1 SuperTokens Core versions 12.2.0 SuperTokens Core versions 12.3.0

Description A licensed deployment with a configured SAML client can authenticate an identity from an assertion that fails the audience check. If the identity provider uses assertion-level signing, an attacker can combine a valid IdP-signed assertion for a victim (intended for any audience) with their own valid assertion for the target audience. This occurs because the validateSamlResponseAudience function accepts an audience from one assertion while the extractAllClaims function retrieves the final NameID and attributes from another. Additionally, an assertion issued to a different SuperTokens deployment using the shared default saml sp entity id can satisfy the audience check of the target deployment. Successful exploitation allows an attacker to authenticate as the victim IdP user.

Recommendations Update to version 11.3.8 Update to version 11.4.8 Update to version 12.0.11 Update to version 12.1.2 Update to version 12.2.1 Update to version 12.3.1