CVE-2026-123800

Summary

In SuperTokens Core versions 6.0.0–6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, insufficient authorization in Multitenancy.checkPermissionsForCreateOrUpdate allows an attacker with a valid API key for one tenant to modify the parent connection URI domain or base tenant configuration, bypassing expected enterprise access controls.

Exploitability

Exploitation requires a valid API key for a non-default tenant in a multi-tenant licensed deployment and knowledge of how to omit the optional identifier to target the base tenant, making it moderately difficult but feasible for an insider or compromised credential holder.

Blast radius

Successful exploitation enables full compromise of sibling tenants—including session hijacking, user data theft, persistence via dashboard users, and denial of service through key replacement—violating confidentiality, integrity, and availability across the entire multi-tenant environment.

Detection

Defenders should monitor for API requests to tenant configuration endpoints (e.g., /multitenancy/config) where the request body omits the optional identifier field and targets a non-default domain or base tenant, especially when combined with elevated privilege changes such as updates to firstFactors, requiredSecondaryFactors, or recipeEnabled flags; log entries showing api_key modifications for sibling tenants by an unrelated application’s key are highly indicative.

Prioritized remediation

Upgrade to SuperTokens Core 6.0.25, 7.0.24, 8.0.8, 9.0.7, 9.1.7, 9.2.8, 9.3.6, 10.0.9, 10.1.10, 11.0.10, 11.1.5, 11.2.5, 11.3.9, 11.4.9, 12.0.12, 12.1.3, 12.2.2, or 12.3.2 as appropriate for the affected branch.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.