SuperTokens
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 10 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from August 7, 2026 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →SuperTokens Core: A session created concurrently with account unlink survives the unlink
SuperTokens Core: WebAuthn sign-in accepts a passkey across tenant boundaries
SuperTokens Core SAML: identity taken from an assertion that never passed the audience check, allowing sign-in as any IdP user
SuperTokens Core: SAML callback accepts a replayed RelayState + SAMLResponse, minting a fresh authorization code on each replay
SuperTokens Core: App-scoped API key can overwrite the parent connection URI domain's credentials and take over sibling applications
SuperTokens Core: Dashboard session tokens are never checked for expiry: `isValidUserSession` ignores the stored `expiry`, so a long-expired admin session still authenticates
SuperTokens Core: SAML XML Signature Wrapping authentication bypass — any IdP user can authenticate as any other user
SuperTokens Core: Unknown tenant path bypasses API key and public-tenant enforcement
CVE-2026-37171: SuperTokens Cocross-tenant session isolation bypass (6.0.0-11.4.0)
SuperTokens Cocross-tenant session isolation bypass (6.0.0-11.4.0)
Monitor SuperTokens in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.