{"id":"CVE-2026-123801","kind":"vulnerability","aliases":["CVE-2026-123801"],"related":[],"title":"SuperTokens Core: SAML login replay lets attackers mint sign-in codes","description":"SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseTo. In the SP-initiated flow, an attacker who obtains a legitimately issued, still-valid SAML response and its matching RelayState can resubmit the pair to /recipe/saml/callback before the assertion's NotOnOrAfter time; in the IdP-initiated flow, the assertion can be replayed without RelayState. The missing Response.InResponseTo check also permits an in-progress login to be completed with an assertion for a different identity and fails to enforce allowIDPInitiatedLogin=false. The callback does not validate Destination or SubjectConfirmationData Recipient and NotOnOrAfter, and each accepted callback mints a fresh, independently redeemable authorization code carrying the captured user's identity. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.","summary":"SuperTokens Core, an open source authentication server, does not check SAML login responses for replay or the expected recipient and session. An attacker who captures a valid SAML response can resubmit it before it expires and obtain a fresh authorization code for the captured user's identity.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["authentication","package","saml","self-hosted","supertokens-core"],"not_affected_if":["managed-hosting","saml-not-enabled"],"how_to_check":"- Check the installed SuperTokens Core version against the fixed versions listed below\n- Check whether the SAML recipe is enabled and used for login (`/recipe/saml/callback` in use)","fix":"- SuperTokens Core `11.3.8`, `11.4.8`, `12.0.11`, `12.1.2`, `12.2.1`, `12.3.1` (fixed in the version line matching your install)","status":"open","published_at":"2026-11-09T19:16:46+00:00","first_seen_at":"2026-11-09T19:28:14+00:00","triaged_at":"2026-11-09T19:29:47+00:00","updated_at":"2026-11-09T19:29:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T19:29:47Z","model":"claude-haiku-5-5","output":{"fix":"- SuperTokens Core `11.3.8`, `11.4.8`, `12.0.11`, `12.1.2`, `12.2.1`, `12.3.1` (fixed in the version line matching your install)","reach":"internet","title":"SuperTokens Core: SAML login replay lets attackers mint sign-in codes","impact":"high","summary":"SuperTokens Core, an open source authentication server, does not check SAML login responses for replay or the expected recipient and session. An attacker who captures a valid SAML response can resubmit it before it expires and obtain a fresh authorization code for the captured user's identity.","audience":"businesses","category":"package","nicknames":[],"who_cares":["self-hosted","saml","supertokens-core","authentication"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker logs in as another user and gets their identity","analyst_note":"","how_to_check":"- Check the installed SuperTokens Core version against the fixed versions listed below\n- Check whether the SAML recipe is enabled and used for login (`/recipe/saml/callback` in use)","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["managed-hosting","saml-not-enabled"],"who_is_affected":"Teams that run a self-hosted SuperTokens Core server with the SAML login flow enabled on a version in the affected ranges (11.3.0 to 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, 12.3.1 before their fixes). Deployments using only other login methods, or managed hosting where the vendor operates the core, can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000802,"input_tokens":4989,"output_tokens":607,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123801':15A,18A '-2026':14A,17A '/recipe/saml/callback':131C '11.3.0':84C '11.3.8':86C,212C '11.4.8':87C,213C '12.0.11':88C,214C '12.1.2':89C,215C '12.2.1':90C,216C '12.3.1':92C,218C 'accept':191C 'allowidpinitiatedlogin':176C 'also':155C 'assert':99C,134C,145C,167C 'attack':7A,50B,111C 'authent':19B,33B,81C 'author':67B,198C 'callback':179C,192C 'captur':52B,71B,202C 'carri':200C 'check':37B,154C 'code':12A,68B,199C 'complet':164C 'consum':96C 'core':2A,27B,29B,76C 'cve':13A,16A 'destin':183C 'differ':170C 'enforc':102C,175C 'expect':45B 'expir':62B 'fail':173C 'fals':177C 'fix':209C 'flow':109C,143C 'fresh':66B,195C 'host':24B 'ident':74B,171C,205C 'identifi':100C 'idp':141C 'idp-initi':140C 'in-progress':158C 'independ':196C 'initi':108C,142C 'issu':116C,207C 'legitim':115C 'let':6A 'login':4A,39B,161C 'match':124C 'mint':8A,193C 'miss':152C 'notonoraft':136C,188C 'obtain':64B,113C 'open':31B,79C 'packag':20B 'pair':129C 'permit':156C 'progress':160C 'recipi':46B,186C 'record':98C 'redeem':197C 'relayst':97C,125C,150C 'replay':5A,42B,148C 'respons':40B,56B,121C 'response.inresponseto':103C,153C 'resubmit':58B,127C 'saml':3A,21B,38B,55B,120C 'saml.handlecallback':93C 'self':23B 'self-host':22B 'server':34B,82C 'session':48B 'sign':10A 'sign-in':9A 'sourc':32B,80C 'sp':107C 'sp-initi':106C 'still':118C 'still-valid':117C 'subjectconfirmationdata':185C 'supertoken':1A,26B,28B,75C 'supertokens-cor':25B 'time':137C 'user':72B,203C 'valid':54B,119C,182C 'version':211C 'without':149C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted SuperTokens Core server with the SAML login flow enabled on a version in the affected ranges (11.3.0 to 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, 12.3.1 before their fixes). Deployments using only other login methods, or managed hosting where the vendor operates the core, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["authentication","high","package","saml","selfhosted","supertokenscore"],"campaign_type":null,"search_a":"'-123801':15A,18A '-2026':14A,17A 'attack':7A 'code':12A 'core':2A 'cve':13A,16A 'let':6A 'login':4A 'mint':8A 'replay':5A 'saml':3A 'sign':10A 'sign-in':9A 'supertoken':1A","search_b":"'attack':50B 'authent':19B,33B 'author':67B 'captur':52B,71B 'check':37B 'code':68B 'core':27B,29B 'expect':45B 'expir':62B 'fresh':66B 'host':24B 'ident':74B 'login':39B 'obtain':64B 'open':31B 'packag':20B 'recipi':46B 'replay':42B 'respons':40B,56B 'resubmit':58B 'saml':21B,38B,55B 'self':23B 'self-host':22B 'server':34B 'session':48B 'sourc':32B 'supertoken':26B,28B 'supertokens-cor':25B 'user':72B 'valid':54B","search_c":"'/recipe/saml/callback':131C '11.3.0':84C '11.3.8':86C,212C '11.4.8':87C,213C '12.0.11':88C,214C '12.1.2':89C,215C '12.2.1':90C,216C '12.3.1':92C,218C 'accept':191C 'allowidpinitiatedlogin':176C 'also':155C 'assert':99C,134C,145C,167C 'attack':111C 'authent':81C 'author':198C 'callback':179C,192C 'captur':202C 'carri':200C 'check':154C 'code':199C 'complet':164C 'consum':96C 'core':76C 'destin':183C 'differ':170C 'enforc':102C,175C 'fail':173C 'fals':177C 'fix':209C 'flow':109C,143C 'fresh':195C 'ident':171C,205C 'identifi':100C 'idp':141C 'idp-initi':140C 'in-progress':158C 'independ':196C 'initi':108C,142C 'issu':116C,207C 'legitim':115C 'login':161C 'match':124C 'mint':193C 'miss':152C 'notonoraft':136C,188C 'obtain':113C 'open':79C 'pair':129C 'permit':156C 'progress':160C 'recipi':186C 'record':98C 'redeem':197C 'relayst':97C,125C,150C 'replay':148C 'respons':121C 'response.inresponseto':103C,153C 'resubmit':127C 'saml':120C 'saml.handlecallback':93C 'server':82C 'sourc':80C 'sp':107C 'sp-initi':106C 'still':118C 'still-valid':117C 'subjectconfirmationdata':185C 'supertoken':75C 'time':137C 'user':203C 'valid':119C,182C 'version':211C 'without':149C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123801","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123801","severity":null,"published_at":"2026-11-09T19:16:46+00:00","modified_at":"2026-11-09T19:16:46+00:00","first_seen_at":"2026-11-09T19:28:14+00:00","fetched_at":"2026-11-09T19:28:14+00:00","note":null}],"documents":[{"id":109130,"url":"https://github.com/supertokens/supertokens-core/commit/075655222f5e72f3683a127e45c83c4174fbd4f7","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109131,"url":"https://github.com/supertokens/supertokens-core/commit/4e05d8cf60287e9d2720140031a8b8f4430d056f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109132,"url":"https://github.com/supertokens/supertokens-core/commit/557835406547d269f5d0e33159630a1873461c38","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109133,"url":"https://github.com/supertokens/supertokens-core/commit/5c42f02e98f67174c6a5a800dd9f8bd5b6e98486","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109134,"url":"https://github.com/supertokens/supertokens-core/commit/b6730e608b2d4562939cd4f41ea07df5f841dfe5","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109135,"url":"https://github.com/supertokens/supertokens-core/commit/ca2bca9bc900c2fd399d508818ad026cc977dcf6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109117,"url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":109137,"url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":109138,"url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":109139,"url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":109140,"url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":109141,"url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}