CVE-2026-123803

Name of the Vulnerable Software and Affected Versions SuperTokens Core versions 10.1.0 through 11.0.8 SuperTokens Core versions 11.1.0 through 11.1.3 SuperTokens Core versions 11.2.0 through 11.2.3 SuperTokens Core versions 11.3.0 through 11.3.7 SuperTokens Core versions 11.4.0 through 11.4.7 SuperTokens Core versions 12.0.0 through 12.0.10 SuperTokens Core versions 12.1.0 through 12.1.1 SuperTokens Core versions 12.2.0 SuperTokens Core versions 12.3.0

Description In multi-tenant deployments using WebAuthn with a shared user pool, the server fails to constrain lookups to the requested tenant and does not verify tenant membership during sign-in. This allows a user with a valid passkey in one tenant to authenticate into another tenant within the same application, even without membership in the target tenant. The issue involves the loadOptionsById Transaction() and getUserInfoByCredentialId Transaction() functions, as well as the WebAuthN.signIn method.

Recommendations Update to version 11.0.9 Update to version 11.1.4 Update to version 11.2.4 Update to version 11.3.8 Update to version 11.4.8 Update to version 12.0.11 Update to version 12.1.2 Update to version 12.2.1 Update to version 12.3.1