CVE-2026-123797: SuperTokens Core: Unknown tenant path bypasses API key and public-tenant enforcement
SuperTokens Core is an open source authentication server. From 12.0.6 until 12.0.8, from 11.4.0 until 11.4.6, from 11.3.0 until 11.3.6, and in versions before 11.3.0, app-specific management requests using an unknown tenant path and an older supported cdi-version can bypass API-key and public-tenant enforcement. In src/main/java/io/supertokens/webserver/WebserverAPI.java, checkIPAccess and assertThatAPIKeyCheckPasses suppress TenantOrAppNotFoundException, while the later app-specific handler resolves app/public storage and the public-tenant guard applies only to CDI versions 5.0 and later. An unauthenticated caller able to reach the Core endpoint can therefore use PUT /ghosttenant/recipe/role and GET /ghosttenant/recipe/roles to create and enumerate application roles without a valid API key. This issue is fixed in versions 11.3.6, 11.4.6, and 12.0.8.
Other sources
SuperTokens Core is an open source authentication server. Prior to 11.3.6, 11.4.6, and 12.0.8, app-specific management requests using an unknown tenant path and an older supported cdi-version can bypass API-key and public-tenant enforcement. In src/main/java/io/supertokens/webserver/WebserverAPI.java, checkIPAccess and assertThatAPIKeyCheckPasses suppress TenantOrAppNotFoundException, while the later app-specific handler resolves app/public storage and the public-tenant guard applies only to CDI versions 5.0 and later. An unauthenticated caller able to reach the Core endpoint can therefore use PUT /ghosttenant/recipe/role and GET /ghosttenant/recipe/roles to create and enumerate application roles without a valid API key. This issue is fixed in versions 11.3.6, 11.4.6, and 12.0.8.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuperTokens Coreto a version that resolves this vulnerability.Fixed in 11.3.6 - Upgrade
Upgrade
SuperTokens Coreto a version that resolves this vulnerability.Fixed in 11.4.6 - Upgrade
Upgrade
SuperTokens Coreto a version that resolves this vulnerability.Fixed in 12.0.8
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running versions before 11.3.0, 11.3.0 through 11.3.5, 11.4.0 through 11.4.5, or 12.0.6 through 12.0.7 are affected when app-specific management requests can use an older supported CDI version. The Core endpoint must also be reachable by the unauthenticated caller.
What does an attacker need to exploit this issue?
An attacker needs network access to the SuperTokens Core endpoint. No API key, account, or user interaction is required; the request uses an unknown tenant path and an older supported CDI version.
What can an unauthenticated attacker do?
They can create application roles with PUT /ghosttenant/recipe/role and enumerate roles with GET /ghosttenant/recipe/roles. These requests bypass API-key and public-tenant enforcement under the affected conditions.
What should be done if patching cannot happen immediately?
Restrict unauthenticated network access to the SuperTokens Core endpoint, since reachability is required for exploitation. Upgrade to 11.3.6, 11.4.6, or 12.0.8 when possible.
How can defenders check for attempted exploitation?
Review Core request logs for PUT requests to an unknown tenant path ending in /recipe/role and GET requests ending in /recipe/roles, especially where an older supported CDI version was used. Also review roles created through these app-specific management requests.