Dashboard / CVE-2026-123804

CVE-2026-123804

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 54/100
Published: 2026-11-09 Modified: 2026-11-12 First seen: 2026-11-09 Status: active

Attack Surface

Network No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: Low
UI: None
S: Unchanged
C: High
I: High
A: None

Description

SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated and revoked the existing sessions. A user who controls the linked login method can exploit this race to retain a signed, database-backed, refreshable session as the former primary identity after that method is unlinked; the session persists until expiry or explicit revocation. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.

Weakness Classification (2)

Affected Software (10)

VendorProductVersion
supertokens supertokens-core >= 7.0.0, < 11.0.0
supertokens supertokens-core >= 11.0.0, < 11.0.9
supertokens supertokens-core >= 11.1.0, < 11.1.4
supertokens supertokens-core >= 11.2.0, < 11.2.4
supertokens supertokens-core >= 11.3.0, < 11.3.8
supertokens supertokens-core >= 11.4.0, < 11.4.8
supertokens supertokens-core >= 12.0.0, < 12.0.11
supertokens supertokens-core >= 12.1.0, < 12.1.2
supertokens supertokens-core >= 12.2.0, < 12.2.1
supertokens supertokens-core >= 12.3.0, < 12.3.1

References & Advisories (21)

Bug Bounty Relevance

54 / 100
✓ Network accessible
✓ No user interaction

CVSS Score

6.8 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS — Exploitation Probability

0.37%
Raw Score 0.003680
Percentile 31.1%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00368
2026-11-12
0.00368
2026-11-10
0.00368

Intelligence Sources

mitre ref →
nvd ref →

External Links