External risk intelligence

SuperTokens Core Tenant Isolation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-37171

SuperTokens Core acts as an authentication and session management service. These services are typically deployed as centralized, network-accessible infrastructure components that backend applications and identity portals rely on to handle user sessions, making them a common target for network-based interaction in web application architectures.

Supertokens

6.0.0 to 11.4.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in SuperTokens Core, an authentication and session management system, could allow an authorized user within one account to access the data and functions of another account. This occurs due to a failure in separating different user accounts, known as tenants. The main concern is confirming if your organization uses this specific software and if it is exposed.

Tenant separation failure allows cross-account data access.
Critical authentication system flaw requires attention.
Confirm SuperTokens Core usage and exposure.

Attack Path

How an attacker could exploit the issue

An attacker who has already authenticated into one tenant of SuperTokens Core can leverage a lack of tenant separation to access sensitive information and functionality belonging to other tenants. This bypasses the intended isolation between different user groups, potentially exposing customer data and allowing unauthorized actions across the application.

Attacker needs to be authenticated.
Vulnerable component is tenant separation.
Risk is cross-tenant data access.

Live Threat

Current exploitation, exposure, and threat context

An authenticated user within one tenant could potentially access sensitive session data, personal information, and other tenants' service endpoints due to a failure in tenant separation. This exposure could occur when the affected service is accessed by an authenticated user.

Tenant data and sessions at risk.
Access to other tenants' data.
Unauthorized access to sensitive information.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts SuperTokens Core installations, likely managed by platform or infrastructure teams responsible for identity and access management services. The first practical step is to inventory all SuperTokens Core deployments, confirm network exposure, identify the business-criticality and accountable owner for each instance, and then prioritize remediation based on this risk assessment.

Platform/Infrastructure teams own resolution.
Verify SuperTokens Core instances and exposure.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SuperTokens Core?

SuperTokens Core is an open-source authentication and session management service. Developers integrate it into their backend applications to handle user logins, session tokens, and identity-related data across multiple user groups, often referred to as tenants.

What does CWE-863 mean for CVE-2026-37171?

CWE-863 refers to Incorrect Authorization. In the context of this vulnerability, the software fails to properly verify that a user has permission to access resources belonging to a different tenant, allowing an authenticated user to perform actions outside their assigned boundary.

How does an attacker trigger this vulnerability?

An attacker must already have legitimate authentication credentials for at least one tenant within the system. Simply being an anonymous or unauthenticated visitor is not enough to trigger this flaw, as the issue stems from the software failing to enforce isolation between two already-authenticated accounts.

Is my deployment at risk according to Halo Surface Signal?

Halo Surface Signal identifies SuperTokens Core as an infrastructure service that is typically network-accessible to backend applications. Because it often sits in a centralized position to manage sessions for various portals, any instance reachable over the network faces a higher risk of cross-tenant interaction.

What steps should I take if I run SuperTokens Core?

Start by identifying all instances of SuperTokens Core within your environment and confirming their version numbers. Verify which ones are currently running versions between 6.0.0 and 11.4.0, determine their network reachability, and coordinate with your infrastructure team to plan and apply the necessary security updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.