CVE-2026-123804
Full vulnerability record from the local CVENow database.
Description
SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated and revoked the existing sessions. A user who controls the linked login method can exploit this race to retain a signed, database-backed, refreshable session as the former primary identity after that method is unlinked; the session persists until expiry or explicit revocation. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Severity
MEDIUM
CVSS score
6.8
(v3.1)
Vulnerability status
Received
Source identifier
Published
2026-11-09 19:16:47.457000
Last modified
2026-11-09 19:16:47.457000
View original CVE JSON
{
"id": "CVE-2026-123804",
"sourceIdentifier": "[email protected]",
"published": "2026-11-09T19:16:47.457",
"lastModified": "2026-11-09T19:16:47.457",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated and revoked the existing sessions. A user who controls the linked login method can exploit this race to retain a signed, database-backed, refreshable session as the former primary identity after that method is unlinked; the session persists until expiry or explicit revocation. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "supertokens",
"product": "supertokens-core",
"versions": [
{
"version": ">= 7.0.0, < 11.0.0",
"status": "affected"
},
{
"version": ">= 11.0.0, < 11.0.9",
"status": "affected"
},
{
"version": ">= 11.1.0, < 11.1.4",
"status": "affected"
},
{
"version": ">= 11.2.0, < 11.2.4",
"status": "affected"
},
{
"version": ">= 11.3.0, < 11.3.8",
"status": "affected"
},
{
"version": ">= 11.4.0, < 11.4.8",
"status": "affected"
},
{
"version": ">= 12.0.0, < 12.0.11",
"status": "affected"
},
{
"version": ">= 12.1.0, < 12.1.2",
"status": "affected"
},
{
"version": ">= 12.2.0, < 12.2.1",
"status": "affected"
},
{
"version": ">= 12.3.0, < 12.3.1",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.6,
"impactScore": 5.2
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-362"
},
{
"lang": "en",
"value": "CWE-613"
}
]
}
],
"references": [
{
"url": "https://github.com/supertokens/supertokens-core/commit/182b39454ac44649cdef22d87f296a38a0b1a602",
"source": "[email protected]"
},
{
"url": "https://github.com/supertokens/supertokens-core/commit/378e1157dc26232a518d2c360ee60cf93c2fd8a2",
"source": "[email protected]"
},
{
"url": "https://github.com/supertokens/supertokens-core/commit/5aec64aca6d765cde491658210e6922e291742fd",
"source": "[email protected]"
},
{
"url": "https://github.com/supertokens/supertokens-core/commit/b1c569ed59fffe16c2f657da1754abcae47d2761",
"source": "[email protected]"
},
{
"url": "https://github.com/supertokens/supertokens-core/commit/b44f1e1418206f411e541501c2e5b9b147add0d9",
"source": "[email protected]"
},
{
"url": "https://github.com/supertokens/supertokens-core/commit/bb6d5f8d1b79770e3cc37f214ba94c3e36e9c3b8",
"source": "[email protected]"
},
{
"url": "https://github.com/supertokens/supertokens-core/commit/c0b7f5eda20840f63f6b0f171d22bd49a7a609a1",
"source": "[email protected]"
},
{
"url": "https://github.com/supertokens/supertokens-core/commit/c8b48e843b323cd749dcb17b6b81c190e7882a43",
"source": "[email protected]"
},
{
"url": "https://github.com/supertokens/supertokens-core/commit/c950a01794cf0983ebd62412976cb80756bf5dd0",
"source": "[email protected]"
},
{
"url": "https://github.com/supertokens/supertokens-core/commit/d456dfbc02f2f7d68be7c05d876bdaa086f9a5b5",
"source": "[email protected]"
},
{
"url": "https://github.com/supertokens/supertokens-core/commit/fc273f5157d3e96f147aa42773607d627d3b495f",
"source": "[email protected]"
},
{
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9",
"source": "[email protected]"
},
{
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4",
"source": "[email protected]"
},
{
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4",
"source": "[email protected]"
},
{
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8",
"source": "[email protected]"
},
{
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8",
"source": "[email protected]"
},
{
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11",
"source": "[email protected]"
},
{
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2",
"source": "[email protected]"
},
{
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1",
"source": "[email protected]"
},
{
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1",
"source": "[email protected]"
},
{
"url": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-2pc4-vw9j-454c",
"source": "[email protected]"
}
]
}