{"id":"CVE-2026-123802","kind":"vulnerability","aliases":["CVE-2026-123802"],"related":[],"title":"SuperTokens Core: SAML audience check bypass lets attackers log in as victims","description":"SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, a licensed deployment with a configured SAML client can authenticate an identity from an assertion that did not satisfy the audience check. When the identity provider uses assertion-level signing, an attacker who has a still-valid IdP-signed assertion naming the victim for any audience and the attacker's own valid assertion for the target audience can combine them because validateSamlResponseAudience accepts an audience from one assertion while extractAllClaims takes the final NameID and attributes from another; response-level signing does not expose this multi-assertion variant. Independently, an assertion from an identity provider configured for the target deployment but issued to another SuperTokens deployment using the shared default saml_sp_entity_id can satisfy the target's audience check. Successful exploitation authenticates the attacker as the victim IdP user. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.","summary":"SuperTokens Core is an open source authentication server whose SAML login path can accept an assertion that failed the audience check, by mixing claims from two signed assertions or reusing an IdP assertion issued to another deployment with the default saml_sp_entity_id. A successful attack authenticates the attacker as the victim's identity provider user.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["authentication","runtime","saml","self-hosted","supertokens"],"not_affected_if":["custom-saml-sp-entity-id","fixed-version","no-saml-client"],"how_to_check":"- Check the running SuperTokens Core version against the affected ranges (`11.3.0` to `11.3.8`, `11.4.x` before `11.4.8`, `12.0.x` before `12.0.11`, `12.1.x` before `12.1.2`, `12.2.x` before `12.2.1`, `12.3.x` before `12.3.1`).\n- Check whether SAML sign-in is configured with a SAML client on a licensed deployment.\n- Check whether `saml_sp_entity_id` is left at the shared default.","fix":"- Upgrade SuperTokens Core to `11.3.8`, `11.4.8`, `12.0.11`, `12.1.2`, `12.2.1`, or `12.3.1` for the matching release line.","status":"open","published_at":"2026-11-09T19:16:47+00:00","first_seen_at":"2026-11-09T19:28:14+00:00","triaged_at":"2026-11-09T19:29:37+00:00","updated_at":"2026-11-09T19:29:37+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-09T19:29:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade SuperTokens Core to `11.3.8`, `11.4.8`, `12.0.11`, `12.1.2`, `12.2.1`, or `12.3.1` for the matching release line.","reach":"internet","title":"SuperTokens Core: SAML audience check bypass lets attackers log in as victims","impact":"high","summary":"SuperTokens Core is an open source authentication server whose SAML login path can accept an assertion that failed the audience check, by mixing claims from two signed assertions or reusing an IdP assertion issued to another deployment with the default saml_sp_entity_id. A successful attack authenticates the attacker as the victim's identity provider user.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["supertokens","saml","self-hosted","authentication"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"attacker logs in as a victim's identity provider user","analyst_note":"","how_to_check":"- Check the running SuperTokens Core version against the affected ranges (`11.3.0` to `11.3.8`, `11.4.x` before `11.4.8`, `12.0.x` before `12.0.11`, `12.1.x` before `12.1.2`, `12.2.x` before `12.2.1`, `12.3.x` before `12.3.1`).\n- Check whether SAML sign-in is configured with a SAML client on a licensed deployment.\n- Check whether `saml_sp_entity_id` is left at the shared default.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-saml-client","fixed-version","custom-saml-sp-entity-id"],"who_is_affected":"Only deployments that run SuperTokens Core with a licensed SAML client configured are exposed. The default shared saml_sp_entity_id makes the second variant possible, and assertion-level signing by the identity provider makes the first. Deployments without SAML, or on the fixed versions, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000864,"input_tokens":4964,"output_tokens":736,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123802':15A,18A '-2026':14A,17A '11.3.0':92C '11.3.8':94C,243C '11.4.8':95C,244C '12.0.11':96C,245C '12.1.2':97C,246C '12.2.1':98C,247C '12.3.1':100C,249C 'accept':39B,166C 'anoth':61B,181C,209C 'assert':41B,53B,58B,115C,129C,143C,156C,171C,192C,196C 'assertion-level':128C 'attack':8A,72B,75B,133C,152C,231C 'attribut':179C 'audienc':4A,45B,121C,149C,160C,168C,225C 'authent':19B,32B,73B,89C,110C,229C 'bypass':6A 'check':5A,46B,122C,226C 'claim':49B 'client':108C 'combin':162C 'configur':106C,201C 'core':2A,27B,84C 'cve':13A,16A 'default':65B,215C 'deploy':62B,103C,205C,211C 'entiti':68B,218C 'exploit':228C 'expos':188C 'extractallclaim':173C 'fail':43B 'final':176C 'fix':240C 'host':24B 'id':69B,219C 'ident':80B,112C,125C,199C 'idp':57B,141C,235C 'idp-sign':140C 'independ':194C 'issu':59B,207C,238C 'let':7A 'level':130C,184C 'licens':102C 'log':9A 'login':36B 'mix':48B 'multi':191C 'multi-assert':190C 'name':144C 'nameid':177C 'one':170C 'open':30B,87C 'path':37B 'provid':81B,126C,200C 'respons':183C 'response-level':182C 'reus':55B 'runtim':20B 'saml':3A,21B,35B,66B,107C,216C 'satisfi':119C,221C 'self':23B 'self-host':22B 'server':33B,90C 'share':214C 'sign':52B,131C,142C,185C 'sourc':31B,88C 'sp':67B,217C 'still':138C 'still-valid':137C 'success':71B,227C 'supertoken':1A,25B,26B,83C,210C 'take':174C 'target':159C,204C,223C 'two':51B 'use':127C,212C 'user':82B,236C 'valid':139C,155C 'validatesamlresponseaudi':165C 'variant':193C 'version':242C 'victim':12A,78B,146C,234C 'whose':34B","nicknames":[],"mitigations":[],"who_affected":"Only deployments that run SuperTokens Core with a licensed SAML client configured are exposed. The default shared saml_sp_entity_id makes the second variant possible, and assertion-level signing by the identity provider makes the first. Deployments without SAML, or on the fixed versions, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["authentication","high","runtime","saml","selfhosted","supertokens"],"campaign_type":null,"search_a":"'-123802':15A,18A '-2026':14A,17A 'attack':8A 'audienc':4A 'bypass':6A 'check':5A 'core':2A 'cve':13A,16A 'let':7A 'log':9A 'saml':3A 'supertoken':1A 'victim':12A","search_b":"'accept':39B 'anoth':61B 'assert':41B,53B,58B 'attack':72B,75B 'audienc':45B 'authent':19B,32B,73B 'check':46B 'claim':49B 'core':27B 'default':65B 'deploy':62B 'entiti':68B 'fail':43B 'host':24B 'id':69B 'ident':80B 'idp':57B 'issu':59B 'login':36B 'mix':48B 'open':30B 'path':37B 'provid':81B 'reus':55B 'runtim':20B 'saml':21B,35B,66B 'self':23B 'self-host':22B 'server':33B 'sign':52B 'sourc':31B 'sp':67B 'success':71B 'supertoken':25B,26B 'two':51B 'user':82B 'victim':78B 'whose':34B","search_c":"'11.3.0':92C '11.3.8':94C,243C '11.4.8':95C,244C '12.0.11':96C,245C '12.1.2':97C,246C '12.2.1':98C,247C '12.3.1':100C,249C 'accept':166C 'anoth':181C,209C 'assert':115C,129C,143C,156C,171C,192C,196C 'assertion-level':128C 'attack':133C,152C,231C 'attribut':179C 'audienc':121C,149C,160C,168C,225C 'authent':89C,110C,229C 'check':122C,226C 'client':108C 'combin':162C 'configur':106C,201C 'core':84C 'default':215C 'deploy':103C,205C,211C 'entiti':218C 'exploit':228C 'expos':188C 'extractallclaim':173C 'final':176C 'fix':240C 'id':219C 'ident':112C,125C,199C 'idp':141C,235C 'idp-sign':140C 'independ':194C 'issu':207C,238C 'level':130C,184C 'licens':102C 'multi':191C 'multi-assert':190C 'name':144C 'nameid':177C 'one':170C 'open':87C 'provid':126C,200C 'respons':183C 'response-level':182C 'saml':107C,216C 'satisfi':119C,221C 'server':90C 'share':214C 'sign':131C,142C,185C 'sourc':88C 'sp':217C 'still':138C 'still-valid':137C 'success':227C 'supertoken':83C,210C 'take':174C 'target':159C,204C,223C 'use':127C,212C 'user':236C 'valid':139C,155C 'validatesamlresponseaudi':165C 'variant':193C 'version':242C 'victim':146C,234C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123802","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123802","severity":null,"published_at":"2026-11-09T19:16:47+00:00","modified_at":"2026-11-09T19:16:47+00:00","first_seen_at":"2026-11-09T19:28:14+00:00","fetched_at":"2026-11-09T19:28:14+00:00","note":null}],"documents":[{"id":109142,"url":"https://github.com/supertokens/supertokens-core/commit/00a15e045323ba8a566ca6f59b70125b4030ab6c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109143,"url":"https://github.com/supertokens/supertokens-core/commit/1645915320c5dfc22bce9029eb7d8364f8df402f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109144,"url":"https://github.com/supertokens/supertokens-core/commit/1d0fd5b40848629295cf86d47be185f92f31e445","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109145,"url":"https://github.com/supertokens/supertokens-core/commit/324686349b21ab46fe465ca5f74294d6c68d3859","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109146,"url":"https://github.com/supertokens/supertokens-core/commit/53f42f496477e7cc3ccd48fe57851fa08d06a248","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109147,"url":"https://github.com/supertokens/supertokens-core/commit/5ffdd887b470035f409d61f85f2186381ad9cdd6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109148,"url":"https://github.com/supertokens/supertokens-core/commit/8e69a85e38709b832869c3bfc83df9a150d6f3cf","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109149,"url":"https://github.com/supertokens/supertokens-core/commit/a2483b692d43294fdb9ad2f8f6f831cca8300081","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109150,"url":"https://github.com/supertokens/supertokens-core/commit/b21760ceb5089b0fa30c8fd46f7bbfc680de56dd","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109151,"url":"https://github.com/supertokens/supertokens-core/commit/c77b13061176d9bd50ed24a9cf50ffbcdf332ee5","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109152,"url":"https://github.com/supertokens/supertokens-core/commit/f4ddc022ef1ee17933efb710c21a960cb4ada083","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109117,"url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}