Description
SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, a licensed deployment with a configured SAML client can authenticate an identity from an assertion that did not satisfy the audience check. When the identity provider uses assertion-level signing, an attacker who has a still-valid IdP-signed assertion naming the victim for any audience and the attacker's own valid assertion for the target audience can combine them because validateSamlResponseAudience accepts an audience from one assertion while extractAllClaims takes the final NameID and attributes from another; response-level signing does not expose this multi-assertion variant. Independently, an assertion from an identity provider configured for the target deployment but issued to another SuperTokens deployment using the shared default saml_sp_entity_id can satisfy the target's audience check. Successful exploitation authenticates the attacker as the victim IdP user. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Published: 2026-11-09
Score: 8.1 High
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://github.com/supertokens/supertokens-core/commit/00a15e045323ba8a566ca6f59b70125b4030ab6c cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/1645915320c5dfc22bce9029eb7d8364f8df402f cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/1d0fd5b40848629295cf86d47be185f92f31e445 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/324686349b21ab46fe465ca5f74294d6c68d3859 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/53f42f496477e7cc3ccd48fe57851fa08d06a248 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/5ffdd887b470035f409d61f85f2186381ad9cdd6 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/8e69a85e38709b832869c3bfc83df9a150d6f3cf cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/a2483b692d43294fdb9ad2f8f6f831cca8300081 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/b21760ceb5089b0fa30c8fd46f7bbfc680de56dd cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/c77b13061176d9bd50ed24a9cf50ffbcdf332ee5 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/f4ddc022ef1ee17933efb710c21a960cb4ada083 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/security/advisories/GHSA-wfg2-vqfg-rqh6 cve-icon cve-icon
History

Mon, 09 Nov 2026 18:30:00 +0000

Type Values Removed Values Added
Description SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, a licensed deployment with a configured SAML client can authenticate an identity from an assertion that did not satisfy the audience check. When the identity provider uses assertion-level signing, an attacker who has a still-valid IdP-signed assertion naming the victim for any audience and the attacker's own valid assertion for the target audience can combine them because validateSamlResponseAudience accepts an audience from one assertion while extractAllClaims takes the final NameID and attributes from another; response-level signing does not expose this multi-assertion variant. Independently, an assertion from an identity provider configured for the target deployment but issued to another SuperTokens deployment using the shared default saml_sp_entity_id can satisfy the target's audience check. Successful exploitation authenticates the attacker as the victim IdP user. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Title SuperTokens Core SAML: identity taken from an assertion that never passed the audience check, allowing sign-in as any IdP user
Weaknesses CWE-1220
CWE-287
CWE-345
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-11-09T18:23:40.216Z

Reserved: 2026-11-06T15:27:56.226Z

Link: CVE-2026-123802

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-09T19:16:47.083

Modified: 2026-11-09T19:16:47.083

Link: CVE-2026-123802

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-09T23:00:14Z

Weaknesses