CVE-2026-123803 · Runtime
NO FIX YET · SEE WHAT TO DO
SuperTokens Core, an open source authentication server, fails to limit WebAuthn passkey lookups and sign-ins to the requested tenant. A user with a valid passkey in one tenant can sign in to another tenant of the same application without being a member there.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run SuperTokens Core in a multi-tenant setup, with WebAuthn passkeys enabled and tenants sharing one user pool, are exposed. Single-tenant deployments, or deployments that do not use WebAuthn, are not affected by the cross-tenant sign-in path described in the sources.
Not affected if no-webauthn, patched-version, single-tenant
Who cares multi-tenant, self-hosted, supertokens-core, webauthn
10.1.0 and the fixed release for its branch.11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, , , or , matching the release branch in use.SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform application-scoped WebAuthn lookups without constraining them to the requested tenant, and WebAuthN.signIn does not verify tenant membership. In a multi-tenant deployment using WebAuthn with a shared user pool, an ordinary user who possesses their own valid passkey in one tenant can submit its assertion to another tenant's sign-in endpoint in the same application and be authenticated there despite having no membership in the target tenant. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
12.1.212.2.112.3.1NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.