{"id":"CVE-2026-123804","kind":"vulnerability","aliases":["CVE-2026-123804"],"related":[],"title":"SuperTokens Core: race lets an unlinked login keep a session","description":"SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated and revoked the existing sessions. A user who controls the linked login method can exploit this race to retain a signed, database-backed, refreshable session as the former primary identity after that method is unlinked; the session persists until expiry or explicit revocation. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.","summary":"SuperTokens Core is an open source authentication server. A race between session creation and account unlinking can leave a session alive as the former primary identity after a linked login method is removed, and that session persists until expiry or explicit revocation.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["authentication","package","self-hosted","supertokens"],"not_affected_if":["default-config","managed-hosting"],"how_to_check":"- Check the SuperTokens Core version in use against the fixed versions listed below.\n- Look for `unlinkAccounts` calls in your application code that detach login methods from primary users.","fix":"- Upgrade to `11.0.9`, `11.1.4`, `11.2.4`, `11.3.8`, `11.4.8`, `12.0.11`, `12.1.2`, `12.2.1` or `12.3.1`, matching your release line.","status":"open","published_at":"2026-11-09T19:16:47+00:00","first_seen_at":"2026-11-09T19:28:14+00:00","triaged_at":"2026-11-09T19:31:48+00:00","updated_at":"2026-11-09T19:31:48+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T19:31:48Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `11.0.9`, `11.1.4`, `11.2.4`, `11.3.8`, `11.4.8`, `12.0.11`, `12.1.2`, `12.2.1` or `12.3.1`, matching your release line.","reach":"network","title":"SuperTokens Core: race lets an unlinked login keep a session","impact":"medium","summary":"SuperTokens Core is an open source authentication server. A race between session creation and account unlinking can leave a session alive as the former primary identity after a linked login method is removed, and that session persists until expiry or explicit revocation.","audience":"businesses","category":"package","nicknames":[],"who_cares":["supertokens","self-hosted","authentication"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Former account holder keeps a refreshable session after unlinking","analyst_note":"","how_to_check":"- Check the SuperTokens Core version in use against the fixed versions listed below.\n- Look for `unlinkAccounts` calls in your application code that detach login methods from primary users.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","managed-hosting"],"who_is_affected":"Teams that run a self-hosted SuperTokens Core server on affected versions from 7.0.0 up to the fixed releases, and that use account linking and unlinking in their login flows. An attacker needs to control a login method that is linked to a primary user. Deployments on other versions or those that do not link and unlink accounts are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000772,"input_tokens":4869,"output_tokens":570,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123804':13A,16A '-2026':12A,15A '11.0.9':76C,157C '11.1.4':77C,158C '11.2.4':78C,159C '11.3.8':79C,160C '11.4.8':80C,161C '12.0.11':81C,162C '12.1.2':82C,163C '12.2.1':83C,164C '12.3.1':85C,166C '7.0.0':74C 'account':37B 'aliv':43B 'authent':17B,29B,71C 'back':130C 'control':115C 'core':2A,24B,66C 'createnewsess':86C 'creation':35B 'cve':11A,14A 'databas':129C 'database-back':128C 'detach':94C 'enumer':106C 'exist':110C 'expiri':61B,147C 'explicit':63B,149C 'exploit':121C 'fix':154C 'former':46B,135C 'host':21B 'ident':48B,137C 'insert':100C 'issu':152C 'keep':8A 'leav':40B 'let':4A 'link':51B,117C 'login':7A,52B,96C,118C 'method':53B,97C,119C,140C 'open':27B,69C 'packag':18B 'persist':59B,145C 'primari':47B,90C,136C 'race':3A,32B,123C 'refresh':131C 'remov':55B 'resolv':88C 'retain':125C 'revoc':64B,150C 'revok':108C 'self':20B 'self-host':19B 'server':30B,72C 'session':10A,34B,42B,58B,102C,111C,132C,144C 'sign':127C 'sourc':28B,70C 'supertoken':1A,22B,23B,65C 'unlink':6A,38B,104C,142C 'unlinkaccount':93C 'user':91C,113C 'version':156C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted SuperTokens Core server on affected versions from 7.0.0 up to the fixed releases, and that use account linking and unlinking in their login flows. An attacker needs to control a login method that is linked to a primary user. Deployments on other versions or those that do not link and unlink accounts are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["authentication","medium","package","selfhosted","supertokens"],"campaign_type":null,"search_a":"'-123804':13A,16A '-2026':12A,15A 'core':2A 'cve':11A,14A 'keep':8A 'let':4A 'login':7A 'race':3A 'session':10A 'supertoken':1A 'unlink':6A","search_b":"'account':37B 'aliv':43B 'authent':17B,29B 'core':24B 'creation':35B 'expiri':61B 'explicit':63B 'former':46B 'host':21B 'ident':48B 'leav':40B 'link':51B 'login':52B 'method':53B 'open':27B 'packag':18B 'persist':59B 'primari':47B 'race':32B 'remov':55B 'revoc':64B 'self':20B 'self-host':19B 'server':30B 'session':34B,42B,58B 'sourc':28B 'supertoken':22B,23B 'unlink':38B","search_c":"'11.0.9':76C,157C '11.1.4':77C,158C '11.2.4':78C,159C '11.3.8':79C,160C '11.4.8':80C,161C '12.0.11':81C,162C '12.1.2':82C,163C '12.2.1':83C,164C '12.3.1':85C,166C '7.0.0':74C 'authent':71C 'back':130C 'control':115C 'core':66C 'createnewsess':86C 'databas':129C 'database-back':128C 'detach':94C 'enumer':106C 'exist':110C 'expiri':147C 'explicit':149C 'exploit':121C 'fix':154C 'former':135C 'ident':137C 'insert':100C 'issu':152C 'link':117C 'login':96C,118C 'method':97C,119C,140C 'open':69C 'persist':145C 'primari':90C,136C 'race':123C 'refresh':131C 'resolv':88C 'retain':125C 'revoc':150C 'revok':108C 'server':72C 'session':102C,111C,132C,144C 'sign':127C 'sourc':70C 'supertoken':65C 'unlink':104C,142C 'unlinkaccount':93C 'user':91C,113C 'version':156C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123804","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123804","severity":null,"published_at":"2026-11-09T19:16:47+00:00","modified_at":"2026-11-09T19:16:47+00:00","first_seen_at":"2026-11-09T19:28:14+00:00","fetched_at":"2026-11-09T19:28:14+00:00","note":null}],"documents":[{"id":109166,"url":"https://github.com/supertokens/supertokens-core/commit/182b39454ac44649cdef22d87f296a38a0b1a602","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109167,"url":"https://github.com/supertokens/supertokens-core/commit/378e1157dc26232a518d2c360ee60cf93c2fd8a2","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109168,"url":"https://github.com/supertokens/supertokens-core/commit/5aec64aca6d765cde491658210e6922e291742fd","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109169,"url":"https://github.com/supertokens/supertokens-core/commit/b1c569ed59fffe16c2f657da1754abcae47d2761","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109170,"url":"https://github.com/supertokens/supertokens-core/commit/b44f1e1418206f411e541501c2e5b9b147add0d9","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109171,"url":"https://github.com/supertokens/supertokens-core/commit/bb6d5f8d1b79770e3cc37f214ba94c3e36e9c3b8","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109172,"url":"https://github.com/supertokens/supertokens-core/commit/c0b7f5eda20840f63f6b0f171d22bd49a7a609a1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109173,"url":"https://github.com/supertokens/supertokens-core/commit/c8b48e843b323cd749dcb17b6b81c190e7882a43","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109174,"url":"https://github.com/supertokens/supertokens-core/commit/c950a01794cf0983ebd62412976cb80756bf5dd0","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109175,"url":"https://github.com/supertokens/supertokens-core/commit/d456dfbc02f2f7d68be7c05d876bdaa086f9a5b5","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109176,"url":"https://github.com/supertokens/supertokens-core/commit/fc273f5157d3e96f147aa42773607d627d3b495f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109114,"url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}