---
id: "CVE-2026-123802"
page: "https://infrastack.ai/live/CVE-2026-123802"
kind: "vulnerability"
aliases: ["CVE-2026-123802"]
title: "SuperTokens Core: SAML audience check bypass lets attackers log in as victims"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["authentication", "runtime", "saml", "self-hosted", "supertokens"]
not_affected_if: ["custom-saml-sp-entity-id", "fixed-version", "no-saml-client"]
published_at: "2026-11-09T19:16:47+00:00"
first_seen_at: "2026-11-09T19:28:14+00:00"
updated_at: "2026-11-09T19:29:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123802", "first_seen_at": "2026-11-09T19:28:14+00:00"}]
exploit_sources: []
---

# SuperTokens Core: SAML audience check bypass lets attackers log in as victims

Link for people: https://infrastack.ai/live/CVE-2026-123802 (this .md is for agents)

SuperTokens Core is an open source authentication server whose SAML login path can accept an assertion that failed the audience check, by mixing claims from two signed assertions or reusing an IdP assertion issued to another deployment with the default saml_sp_entity_id. A successful attack authenticates the attacker as the victim's identity provider user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running SuperTokens Core version against the affected ranges (`11.3.0` to `11.3.8`, `11.4.x` before `11.4.8`, `12.0.x` before `12.0.11`, `12.1.x` before `12.1.2`, `12.2.x` before `12.2.1`, `12.3.x` before `12.3.1`).
- Check whether SAML sign-in is configured with a SAML client on a licensed deployment.
- Check whether `saml_sp_entity_id` is left at the shared default.

## Fix

- Upgrade SuperTokens Core to `11.3.8`, `11.4.8`, `12.0.11`, `12.1.2`, `12.2.1`, or `12.3.1` for the matching release line.

## Timeline

- 2026-11-09T19:28:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123802

## Documents

- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/00a15e045323ba8a566ca6f59b70125b4030ab6c
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/1645915320c5dfc22bce9029eb7d8364f8df402f
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/1d0fd5b40848629295cf86d47be185f92f31e445
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/324686349b21ab46fe465ca5f74294d6c68d3859
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/53f42f496477e7cc3ccd48fe57851fa08d06a248
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/5ffdd887b470035f409d61f85f2186381ad9cdd6
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/8e69a85e38709b832869c3bfc83df9a150d6f3cf
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/a2483b692d43294fdb9ad2f8f6f831cca8300081
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/b21760ceb5089b0fa30c8fd46f7bbfc680de56dd
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/c77b13061176d9bd50ed24a9cf50ffbcdf332ee5
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/f4ddc022ef1ee17933efb710c21a960cb4ada083
- [fix] Release notes: github.com https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8

## From the sources

SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, a licensed deployment with a configured SAML client can authenticate an identity from an assertion that did not satisfy the audience check. When the identity provider uses assertion-level signing, an attacker who has a still-valid IdP-signed assertion naming the victim for any audience and the attacker's own valid assertion for the target audience can combine them because validateSamlResponseAudience accepts an audience from one assertion while extractAllClaims takes the final NameID and attributes from another; response-level signing does not expose this multi-assertion variant. Independently, an assertion from an identity provider configured for the target deployment but issued to another SuperTokens deployment using the shared default saml_sp_entity_id can satisfy the target's audience check. Successful exploitation authenticates the attacker as the victim IdP user. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_