CVE-2026-123804

Name of the Vulnerable Software and Affected Versions SuperTokens Core versions 7.0.0 through 11.0.8 SuperTokens Core versions 11.1.0 through 11.1.3 SuperTokens Core versions 11.2.0 through 11.2.3 SuperTokens Core versions 11.3.0 through 11.3.7 SuperTokens Core versions 11.4.0 through 11.4.7 SuperTokens Core versions 12.0.0 through 12.0.10 SuperTokens Core versions 12.1.0 through 12.1.1 SuperTokens Core versions 12.2.0 SuperTokens Core versions 12.3.0

Description A race condition exists where the createNewSession() function can resolve a primary user before the unlinkAccounts() function detaches a login method. The session is then inserted after the unlink process has already enumerated and revoked existing sessions. An attacker controlling the linked login method can exploit this to maintain a signed, database-backed, and refreshable session as the former primary identity after the method is unlinked. This session remains active until it expires or is explicitly revoked.

Recommendations Update to version 11.0.9 Update to version 11.1.4 Update to version 11.2.4 Update to version 11.3.8 Update to version 11.4.8 Update to version 12.0.11 Update to version 12.1.2 Update to version 12.2.1 Update to version 12.3.1