CVE-2026-123797

HIGH

MEDIUM Priority: 0.03 BB Relevance: 75/100

Published: 2026-11-09 Modified: 2026-11-12 First seen: 2026-11-09 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Network

AC: Low

PR: None

UI: None

S: Unchanged

C: None

I: High

A: None

Description

SuperTokens Core is an open source authentication server. Prior to 11.3.6, 11.4.6, and 12.0.8, app-specific management requests using an unknown tenant path and an older supported cdi-version can bypass API-key and public-tenant enforcement. In src/main/java/io/supertokens/webserver/WebserverAPI.java, checkIPAccess and assertThatAPIKeyCheckPasses suppress TenantOrAppNotFoundException, while the later app-specific handler resolves app/public storage and the public-tenant guard applies only to CDI versions 5.0 and later. An unauthenticated caller able to reach the Core endpoint can therefore use PUT /ghosttenant/recipe/role and GET /ghosttenant/recipe/roles to create and enumerate application roles without a valid API key. This issue is fixed in versions 11.3.6, 11.4.6, and 12.0.8.

Weakness Classification (1)

CWE-288 — CWE-288: Authentication Bypass Using an Alternate Path or Channel

Affected Software (9)

Vendor	Product	Version
supertokens	supertokens-core	< 11.3.6
supertokens	supertokens-core	>= 11.4.0, < 11.4.6
supertokens	supertokens-core	>= 12.0.6, < 12.0.8
supertokens	supertokens-core	< 11.3.6
supertokens	supertokens-core	>= 11.4.0, < 11.4.6
supertokens	supertokens-core	>= 12.0.6, < 12.0.8
supertokens	supertokens-core	< 11.3.6
supertokens	supertokens-core	>= 11.4.0, < 11.4.6
supertokens	supertokens-core	>= 12.0.6, < 12.0.8