Answer in brief
CVE-2026-123798 records a High severity (CVSS 8.1) vulnerability in SuperTokens Core: SAML XML Signature Wrapping authentication bypass — any IdP user can authenticate as any other user. The current sources do not mark it as known exploited. The current feed maps supertokens/supertokens-core (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps supertokens/supertokens-core (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| supertokens/supertokens-coregeneric | >=12.0.6 <12.0.10 || >=11.4.0 <11.4.7 || >=11.3.0 <11.3.7 | 12.0.10, 11.4.7, 11.3.7 |
Published upstream
Nov 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 9, 2026
SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.7, 11.4.7, and 12.0.10, SAML.verifySamlResponseSignature calls OpenSAML SignatureValidator.validate without first applying SAMLSignatureProfileValidator. The Core can therefore accept a cryptographically valid signature that references a different XML element from the Response or Assertion whose NameID and attributes are used for authentication. An ordinary user of the configured identity provider can move a genuinely signed element elsewhere in the document while supplying an attacker-authored identity-bearing element, causing XML Signature Wrapping authentication as another IdP user. Both response-level and assertion-level signing paths are affected, and SP-initiated login remains reachable without enabling allowIDPInitiatedLogin. This issue is fixed in versions 11.3.7, 11.4.7, and 12.0.10.
Quoted source text, attributed separately from HOL analysis.