SuperTokens Core: WebAuthn sign-in accepts a passkey across tenant boundaries (CVE-2026-123803)

Why this deserves its current priority

CVSS is 8.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps supertokens/supertokens-core (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
supertokens/supertokens-coregeneric	>=10.1.0 <11.0.0 \|\| >=11.0.0 <11.0.9 \|\| >=11.1.0 <11.1.4 \|\| >=11.2.0 <11.2.4 \|\| >=11.3.0 <11.3.8 \|\| >=11.4.0 <11.4.8 \|\| >=12.0.0 <12.0.11 \|\| >=12.1.0 <12.1.2 \|\| >=12.2.0 <12.2.1 \|\| >=12.3.0 <12.3.1	11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, 12.3.1

Recommended response

Check inventory. Check lockfiles and deployed manifests for supertokens/supertokens-core.
Review the reported fix. Update supertokens/supertokens-core to 11.0.9 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Nov 9, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Nov 9, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Nov 9, 2026

Sources and claim methodology

Upstream source description

SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform application-scoped WebAuthn lookups without constraining them to the requested tenant, and WebAuthN.signIn does not verify tenant membership. In a multi-tenant deployment using WebAuthn with a shared user pool, an ordinary user who possesses their own valid passkey in one tenant can submit its assertion to another tenant's sign-in endpoint in the same application and be authenticated there despite having no membership in the target tenant. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.

Quoted source text, attributed separately from HOL analysis.

SuperTokens Core: WebAuthn sign-in accepts a passkey across tenant boundariesCVE-2026-123803