CVE-2026-123797 · Package
NO FIX YET · SEE WHAT TO DO
SuperTokens Core is an open source authentication server. Requests using an unknown tenant path and an older cdi-version skip the API-key and public-tenant checks, letting an unauthenticated caller create and enumerate application roles.
first public Oct 16, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running a self-hosted SuperTokens Core server that can be reached by unauthenticated callers. Managed hosting or deployments where the Core is not exposed to untrusted networks are less exposed, but the sources do not say which configurations are safe.
Not affected if core-not-exposed, managed-hosting
Who cares authentication, self-hosted, supertokens
PUT /ghosttenant/recipe/role and GET /ghosttenant/recipe/roles reachable from outside your network.11.3.6, 11.4.6, or 12.0.8, matching your release line.SuperTokens Core is an open source authentication server. Prior to 11.3.6, 11.4.6, and 12.0.8, app-specific management requests using an unknown tenant path and an older supported cdi-version can bypass API-key and public-tenant enforcement. In src/main/java/io/supertokens/webserver/WebserverAPI.java, checkIPAccess and assertThatAPIKeyCheckPasses suppress TenantOrAppNotFoundException, while the later app-specific handler resolves app/public storage and the public-tenant guard applies only to CDI versions 5.0 and later. An unauthenticated caller able to reach the Core endpoint can therefore use PUT /ghosttenant/recipe/role and GET /ghosttenant/recipe/roles to create and enumerate application roles without a valid API key. This issue is fixed in versions 11.3.6, 11.4.6, and 12.0.8.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.