CVE-2026-123803: SuperTokens Core: WebAuthn sign-in accepts a passkey across tenant boundaries
SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsByIdTransaction and getUserInfoByCredentialIdTransaction perform application-scoped WebAuthn lookups without constraining them to the requested tenant, and WebAuthN.signIn does not verify tenant membership. In a multi-tenant deployment using WebAuthn with a shared user pool, an ordinary user who possesses their own valid passkey in one tenant can submit its assertion to another tenant's sign-in endpoint in the same application and be authenticated there despite having no membership in the target tenant. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuperTokens Coreto a version that resolves this vulnerability.Fixed in 12.3.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects multi-tenant deployments that use WebAuthn with a shared user pool. It depends on users and passkeys being usable within the same application across tenant-specific sign-in endpoints.
What does an attacker need to exploit it?
The attacker needs to be an ordinary user with a valid passkey in one tenant. They can submit that passkey assertion to another tenant's sign-in endpoint in the same application, even if they are not a member of the target tenant.
Which versions contain the fix?
Fixed releases are 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1. Upgrade to the applicable fixed release for the version line in use.