---
id: "CVE-2026-123803"
page: "https://infrastack.ai/live/CVE-2026-123803"
kind: "vulnerability"
aliases: ["CVE-2026-123803"]
title: "SuperTokens Core: passkey login lets users sign into other tenants"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["multi-tenant", "runtime", "self-hosted", "supertokens-core", "webauthn"]
not_affected_if: ["no-webauthn", "patched-version", "single-tenant"]
published_at: "2026-11-09T19:16:47+00:00"
first_seen_at: "2026-11-09T19:28:14+00:00"
updated_at: "2026-11-09T19:29:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123803", "first_seen_at": "2026-11-09T19:28:14+00:00"}]
exploit_sources: []
---

# SuperTokens Core: passkey login lets users sign into other tenants

Link for people: https://infrastack.ai/live/CVE-2026-123803 (this .md is for agents)

SuperTokens Core, an open source authentication server, fails to limit WebAuthn passkey lookups and sign-ins to the requested tenant. A user with a valid passkey in one tenant can sign in to another tenant of the same application without being a member there.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the deployed SuperTokens Core version is between `10.1.0` and the fixed release for its branch.
- Check whether the application runs several tenants that share one user pool and uses WebAuthn passkey sign-in.

## Fix

- Upgrade to `11.0.9`, `11.1.4`, `11.2.4`, `11.3.8`, `11.4.8`, `12.0.11`, `12.1.2`, `12.2.1`, or `12.3.1`, matching the release branch in use.

## Timeline

- 2026-11-09T19:28:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123803

## Documents

- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/01ca34a06baa0d22db008f38c8eabd1f6695d9a6
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/030643edea5d69e0009ceeecbc5dd70be5c66186
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/1e3e4d9b25237a9c8fd77cbe0d4d0ecb360d8cd6
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/84492e38f9eb6db0cc338674ce5e94d1603bef08
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/982d420a5ac29d5e362eaf39169a7a9f5339abeb
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/a3d033022effb00ccf0c4ec6ca77c36eb1a24617
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/ad768c1925e245930e5fbf9441452d85564de91d
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/b933b6c9b4495e47a8b3efeb5a70e9d014777320
- [fix] Patch: github.com https://github.com/supertokens/supertokens-core/commit/e19d173f47658d036685d3020e18819c5f3690b7
- [fix] Release notes: github.com https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9
- [fix] Release notes: github.com https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4
- [fix] Release notes: github.com https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4

## From the sources

SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform application-scoped WebAuthn lookups without constraining them to the requested tenant, and WebAuthN.signIn does not verify tenant membership. In a multi-tenant deployment using WebAuthn with a shared user pool, an ordinary user who possesses their own valid passkey in one tenant can submit its assertion to another tenant's sign-in endpoint in the same application and be authenticated there despite having no membership in the target tenant. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_