{"id":"CVE-2026-123797","kind":"vulnerability","aliases":["CVE-2026-123797"],"related":[],"title":"SuperTokens Core: unauthenticated callers can create and list app roles","description":"SuperTokens Core is an open source authentication server. Prior to 11.3.6, 11.4.6, and 12.0.8, app-specific management requests using an unknown tenant path and an older supported cdi-version can bypass API-key and public-tenant enforcement. In src/main/java/io/supertokens/webserver/WebserverAPI.java, checkIPAccess and assertThatAPIKeyCheckPasses suppress TenantOrAppNotFoundException, while the later app-specific handler resolves app/public storage and the public-tenant guard applies only to CDI versions 5.0 and later. An unauthenticated caller able to reach the Core endpoint can therefore use PUT /ghosttenant/recipe/role and GET /ghosttenant/recipe/roles to create and enumerate application roles without a valid API key. This issue is fixed in versions 11.3.6, 11.4.6, and 12.0.8.","summary":"SuperTokens Core is an open source authentication server. Requests using an unknown tenant path and an older cdi-version skip the API-key and public-tenant checks, letting an unauthenticated caller create and enumerate application roles.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["authentication","package","self-hosted","supertokens"],"not_affected_if":["core-not-exposed","managed-hosting"],"how_to_check":"- Check the installed SuperTokens Core version against the fixed versions listed below.\n- Look for the Core endpoints `PUT /ghosttenant/recipe/role` and `GET /ghosttenant/recipe/roles` reachable from outside your network.","fix":"- Upgrade to `11.3.6`, `11.4.6`, or `12.0.8`, matching your release line.","status":"open","published_at":"2026-11-09T18:17:26+00:00","first_seen_at":"2026-11-09T18:27:56+00:00","triaged_at":"2026-11-09T18:29:12+00:00","updated_at":"2026-11-09T18:29:12+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T18:29:12Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `11.3.6`, `11.4.6`, or `12.0.8`, matching your release line.","reach":"internet","title":"SuperTokens Core: unauthenticated callers can create and list app roles","impact":"medium","summary":"SuperTokens Core is an open source authentication server. Requests using an unknown tenant path and an older cdi-version skip the API-key and public-tenant checks, letting an unauthenticated caller create and enumerate application roles.","audience":"businesses","category":"package","nicknames":[],"who_cares":["supertokens","self-hosted","authentication"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated callers create and enumerate application roles","analyst_note":"","how_to_check":"- Check the installed SuperTokens Core version against the fixed versions listed below.\n- Look for the Core endpoints `PUT /ghosttenant/recipe/role` and `GET /ghosttenant/recipe/roles` reachable from outside your network.","plain_action":"","product_name":"supertokens-core","needs_analyst":false,"not_affected_if":["managed-hosting","core-not-exposed"],"who_is_affected":"Teams running a self-hosted SuperTokens Core server that can be reached by unauthenticated callers. Managed hosting or deployments where the Core is not exposed to untrusted networks are less exposed, but the sources do not say which configurations are safe.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00076,"input_tokens":4833,"output_tokens":553,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123797':13A,16A '-2026':12A,15A '/ghosttenant/recipe/role':147C '/ghosttenant/recipe/roles':150C '11.3.6':72C,168C '11.4.6':73C,169C '12.0.8':75C,171C '5.0':131C 'abl':137C 'api':46B,96C,160C 'api-key':45B,95C 'app':9A,77C,114C 'app-specif':76C,113C 'app/public':118C 'appli':126C 'applic':60B,155C 'assertthatapikeycheckpass':107C 'authent':17B,29B,68C 'bypass':94C 'caller':4A,56B,136C 'cdi':41B,91C,129C 'cdi-vers':40B,90C 'check':52B 'checkipaccess':105C 'core':2A,24B,63C,141C 'creat':6A,57B,152C 'cve':11A,14A 'endpoint':142C 'enforc':102C 'enumer':59B,154C 'fix':165C 'get':149C 'guard':125C 'handler':116C 'host':21B 'issu':163C 'key':47B,97C,161C 'later':112C,133C 'let':53B 'list':8A 'manag':79C 'older':39B,88C 'open':27B,66C 'packag':18B 'path':36B,85C 'prior':70C 'public':50B,100C,123C 'public-ten':49B,99C,122C 'put':146C 'reach':139C 'request':31B,80C 'resolv':117C 'role':10A,61B,156C 'self':20B 'self-host':19B 'server':30B,69C 'skip':43B 'sourc':28B,67C 'specif':78C,115C 'src/main/java/io/supertokens/webserver/webserverapi.java':104C 'storag':119C 'supertoken':1A,22B,23B,62C 'support':89C 'suppress':108C 'tenant':35B,51B,84C,101C,124C 'tenantorappnotfoundexcept':109C 'therefor':144C 'unauthent':3A,55B,135C 'unknown':34B,83C 'use':32B,81C,145C 'valid':159C 'version':42B,92C,130C,167C 'without':157C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted SuperTokens Core server that can be reached by unauthenticated callers. Managed hosting or deployments where the Core is not exposed to untrusted networks are less exposed, but the sources do not say which configurations are safe.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["authentication","high","package","selfhosted","supertokens"],"campaign_type":null,"search_a":"'-123797':13A,16A '-2026':12A,15A 'app':9A 'caller':4A 'core':2A 'creat':6A 'cve':11A,14A 'list':8A 'role':10A 'supertoken':1A 'unauthent':3A","search_b":"'api':46B 'api-key':45B 'applic':60B 'authent':17B,29B 'caller':56B 'cdi':41B 'cdi-vers':40B 'check':52B 'core':24B 'creat':57B 'enumer':59B 'host':21B 'key':47B 'let':53B 'older':39B 'open':27B 'packag':18B 'path':36B 'public':50B 'public-ten':49B 'request':31B 'role':61B 'self':20B 'self-host':19B 'server':30B 'skip':43B 'sourc':28B 'supertoken':22B,23B 'tenant':35B,51B 'unauthent':55B 'unknown':34B 'use':32B 'version':42B","search_c":"'/ghosttenant/recipe/role':147C '/ghosttenant/recipe/roles':150C '11.3.6':72C,168C '11.4.6':73C,169C '12.0.8':75C,171C '5.0':131C 'abl':137C 'api':96C,160C 'api-key':95C 'app':77C,114C 'app-specif':76C,113C 'app/public':118C 'appli':126C 'applic':155C 'assertthatapikeycheckpass':107C 'authent':68C 'bypass':94C 'caller':136C 'cdi':91C,129C 'cdi-vers':90C 'checkipaccess':105C 'core':63C,141C 'creat':152C 'endpoint':142C 'enforc':102C 'enumer':154C 'fix':165C 'get':149C 'guard':125C 'handler':116C 'issu':163C 'key':97C,161C 'later':112C,133C 'manag':79C 'older':88C 'open':66C 'path':85C 'prior':70C 'public':100C,123C 'public-ten':99C,122C 'put':146C 'reach':139C 'request':80C 'resolv':117C 'role':156C 'server':69C 'sourc':67C 'specif':78C,115C 'src/main/java/io/supertokens/webserver/webserverapi.java':104C 'storag':119C 'supertoken':62C 'support':89C 'suppress':108C 'tenant':84C,101C,124C 'tenantorappnotfoundexcept':109C 'therefor':144C 'unauthent':135C 'unknown':83C 'use':81C,145C 'valid':159C 'version':92C,130C,167C 'without':157C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-16T13:03:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123797","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123797","severity":null,"published_at":"2026-11-09T18:17:26+00:00","modified_at":"2026-11-09T18:17:26+00:00","first_seen_at":"2026-11-09T18:27:56+00:00","fetched_at":"2026-11-09T18:27:56+00:00","note":null}],"documents":[{"id":108813,"url":"https://github.com/supertokens/supertokens-core/commit/1bad648d7b77aca058cb6bf75373455bacc4e537","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":108814,"url":"https://github.com/supertokens/supertokens-core/commit/5811a10190b1d4d8d7a9fe2e17cb49437e6ffa49","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":108815,"url":"https://github.com/supertokens/supertokens-core/commit/7ce22db2b6ba95d7666adc51bb9ee60ac7d3d198","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":108816,"url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.3.6","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":108817,"url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.4.6","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":108818,"url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.0.8","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":108819,"url":"https://github.com/supertokens/supertokens-core/security/advisories/GHSA-q7mc-f2jm-r4gr","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-16T13:03:28+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}