---
id: "CVE-2026-123798"
page: "https://infrastack.ai/live/CVE-2026-123798"
kind: "vulnerability"
aliases: ["CVE-2026-123798"]
title: "SuperTokens Core: SAML signature check lets attackers log in as other users"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "SuperTokens Core", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["runtime", "saml", "self-hosted", "supertokens-core"]
not_affected_if: ["patched-version", "saml-not-used"]
published_at: "2026-11-09T19:16:46+00:00"
first_seen_at: "2026-11-09T19:28:14+00:00"
updated_at: "2026-11-09T19:29:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123798", "first_seen_at": "2026-11-09T19:28:14+00:00"}]
exploit_sources: []
---

# SuperTokens Core: SAML signature check lets attackers log in as other users

Link for people: https://infrastack.ai/live/CVE-2026-123798 (this .md is for agents)

SuperTokens Core accepts a validly signed SAML response without confirming that the signed element is the one used for login. A user of the configured identity provider can wrap a signed element and supply their own identity, which authenticates them as another user.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SuperTokens Core affected range not listed fixed no fixed version listed

## Fix

- Upgrade to `11.3.7`, `11.4.7`, or `12.0.10`, matching your release line.

## Timeline

- 2026-11-09T19:28:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123798

## Documents

- [advisory] Vendor advisory: github.com https://github.com/supertokens/supertokens-core/security/advisories/GHSA-gvx2-mwmj-wwvj
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/9cba541ae2ed87b878d11b257bc9b8b78341f50a
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/d0773f2a6497411aeda5d4f03d3d135a2a3ae79c
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/8d06b0cfb5409c5bf505051ddfcb94d66367caae
- [fix] Release notes: github.com https://github.com/supertokens/supertokens-core/releases/tag/v11.4.7
- [fix] Release notes: github.com https://github.com/supertokens/supertokens-core/releases/tag/v12.0.10
- [fix] Release notes: github.com https://github.com/supertokens/supertokens-core/releases/tag/v11.3.7

## From the sources

SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.7, 11.4.7, and 12.0.10, SAML.verifySamlResponseSignature calls OpenSAML SignatureValidator.validate without first applying SAMLSignatureProfileValidator. The Core can therefore accept a cryptographically valid signature that references a different XML element from the Response or Assertion whose NameID and attributes are used for authentication. An ordinary user of the configured identity provider can move a genuinely signed element elsewhere in the document while supplying an attacker-authored identity-bearing element, causing XML Signature Wrapping authentication as another IdP user. Both response-level and assertion-level signing paths are affected, and SP-initiated login remains reachable without enabling allowIDPInitiatedLogin. This issue is fixed in versions 11.3.7, 11.4.7, and 12.0.10.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_