---
id: "CVE-2026-123801"
page: "https://infrastack.ai/live/CVE-2026-123801"
kind: "vulnerability"
aliases: ["CVE-2026-123801"]
title: "SuperTokens Core: SAML login replay lets attackers mint sign-in codes"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["authentication", "package", "saml", "self-hosted", "supertokens-core"]
not_affected_if: ["managed-hosting", "saml-not-enabled"]
published_at: "2026-11-09T19:16:46+00:00"
first_seen_at: "2026-11-09T19:28:14+00:00"
updated_at: "2026-11-09T19:29:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123801", "first_seen_at": "2026-11-09T19:28:14+00:00"}]
exploit_sources: []
---

# SuperTokens Core: SAML login replay lets attackers mint sign-in codes

Link for people: https://infrastack.ai/live/CVE-2026-123801 (this .md is for agents)

SuperTokens Core, an open source authentication server, does not check SAML login responses for replay or the expected recipient and session. An attacker who captures a valid SAML response can resubmit it before it expires and obtain a fresh authorization code for the captured user's identity.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SuperTokens Core version against the fixed versions listed below
- Check whether the SAML recipe is enabled and used for login (`/recipe/saml/callback` in use)

## Fix

- SuperTokens Core `11.3.8`, `11.4.8`, `12.0.11`, `12.1.2`, `12.2.1`, `12.3.1` (fixed in the version line matching your install)

## Timeline

- 2026-11-09T19:28:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123801

## Documents

- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/075655222f5e72f3683a127e45c83c4174fbd4f7
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/4e05d8cf60287e9d2720140031a8b8f4430d056f
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/557835406547d269f5d0e33159630a1873461c38
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/5c42f02e98f67174c6a5a800dd9f8bd5b6e98486
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/b6730e608b2d4562939cd4f41ea07df5f841dfe5
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/ca2bca9bc900c2fd399d508818ad026cc977dcf6
- [fix] Release notes: github.com https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8
- [fix] Release notes: github.com https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8
- [fix] Release notes: github.com https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11
- [fix] Release notes: github.com https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2
- [fix] Release notes: github.com https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1
- [fix] Release notes: github.com https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1

## From the sources

SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseTo. In the SP-initiated flow, an attacker who obtains a legitimately issued, still-valid SAML response and its matching RelayState can resubmit the pair to /recipe/saml/callback before the assertion's NotOnOrAfter time; in the IdP-initiated flow, the assertion can be replayed without RelayState. The missing Response.InResponseTo check also permits an in-progress login to be completed with an assertion for a different identity and fails to enforce allowIDPInitiatedLogin=false. The callback does not validate Destination or SubjectConfirmationData Recipient and NotOnOrAfter, and each accepted callback mints a fresh, independently redeemable authorization code carrying the captured user's identity. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_