External risk intelligence

SuperTokens Core Multitenancy Authorization Bypass Leading to Tenant Data Compromise.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-123800

SuperTokens is an authentication server designed to be public-facing by design in normal deployment, acting as an identity and access management gateway. It serves as the primary endpoint for application authentication, making it an inherently internet-facing service that manages login integrity, user sessions, and API connectivity.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in SuperTokens Core, an open-source authentication server, allowing unauthorized users to potentially compromise tenant configurations and gain broad access to application data and user sessions. This issue could enable attackers to impersonate users, modify authentication settings, and disrupt service availability within multi-tenant environments.

Attackers could alter core authentication settings.
It impacts secure management of multi-tenant applications.
Verify SuperTokens Core is not exposed to unauthorized access.

Attack Path

How an attacker could exploit the issue

An attacker with API keys for one application within a SuperTokens Core multi-tenant deployment can exploit this vulnerability. By manipulating the connection URI domain or base tenant settings, they can gain unauthorized access to other applications within the same deployment. This could lead to reading or modifying user data, impersonating users, and establishing persistent access.

Requires valid API key for one app.
Update parent connection URI domain or base tenant.
Compromise sibling apps, users, and sessions.

Live Threat

Current exploitation, exposure, and threat context

In a licensed multi-tenant SuperTokens Core deployment, an attacker with a valid API key for one application could exploit this vulnerability. This could allow them to update the parent connection URI domain, potentially leading to the replacement of API keys, unauthorized access to user data and sessions across sibling applications, and the establishment of persistence through a dashboard user. The vulnerability may also affect login integrity and availability by altering authentication configurations.

Authentication service and tenant data at risk.
Unauthorized API key updates and domain changes.
Compromised user data and session hijacking.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given SuperTokens Core's role as an authentication server, application owners and platform teams are likely responsible for addressing this vulnerability. The immediate practical step is to identify all instances of SuperTokens Core across your environment, confirm their reachability and criticality, and then engage the accountable owners to plan remediation.

Identify all SuperTokens Core instances.
Verify instance reachability and business criticality.
Plan and coordinate remediation efforts.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SuperTokens Core?

SuperTokens Core is an open-source authentication server that acts as a central identity and access management gateway. Developers use it to manage user sessions, handle login flows, and secure API connectivity for their applications. It is typically deployed as a foundational service that applications rely on to verify user identities and manage secure access.

What does CVE-2026-123800 mean for security?

This vulnerability is classified as an authorization bypass (CWE-639 and CWE-863). Essentially, the software fails to properly check if a user is allowed to perform administrative updates in a multi-tenant environment. Because these checks are missing, an authenticated user can perform actions they shouldn't have permission to, such as modifying authentication settings or accessing data belonging to other tenants.

How can this vulnerability be triggered?

An attacker needs a valid API key for one application within a multi-tenant SuperTokens Core setup to initiate the attack. They can then attempt to modify the parent connection URI or base tenant settings. Note that simply omitting an identifier in certain requests can trigger a path that bypasses intended permission gates, though this specific variant does not allow for full API key theft.

Is my instance at risk?

According to Halo Surface Signal, SuperTokens Core is designed to be public-facing as an identity gateway. If you are running a multi-tenant deployment, you should assume a higher risk level because the service is inherently internet-facing. This exposure increases the likelihood that an attacker with access to one tenant could attempt to reach across the system to compromise sibling applications.

What should I do to respond to this?

First, locate every instance of SuperTokens Core running in your environment. Once identified, verify if you are using a multi-tenant configuration, as this is the primary scope of the vulnerability. Consult the list of fixed versions in the advisory and coordinate with your platform team to update your software to a patched release immediately.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.