CVE-2026-123804: SuperTokens Core: A session created concurrently with account unlink survives the unlink

Q: Who can exploit this issue?

An attacker must control a login method that is linked to a primary user identity and must be able to race session creation against unlinking that login method. The attack requires low privileges and network access, but the race condition makes exploitation high complexity.

Q: What is the impact if the race succeeds?

The attacker can retain a signed, database-backed, refreshable session for the former primary identity after their linked login method has been unlinked. That session remains valid until it expires or is explicitly revoked.

Q: Which releases should be updated?

Affected releases begin at 7.0.0 and include versions before the fixed releases in each supported line. Update to 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, or 12.3.1, as applicable to your release line.

Q: What can be done if an immediate update is not possible?

Explicitly revoke sessions for identities whose linked login methods are unlinked. This is necessary because a session created during the race can persist after the unlink until expiry or explicit revocation.

Published Nov 9, 2026

Updated

SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated and revoked the existing sessions. A user who controls the linked login method can exploit this race to retain a signed, database-backed, refreshable session as the former primary identity after that method is unlinked; the session persists until expiry or explicit revocation. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.

Affected Software

1 affected component

SuperTokens SuperTokens Core>=7.0.0<11.0.9, >=11.1.0<11.1.4, >=11.2.0<11.2.4, >=11.3.0<11.3.8, >=11.4.0<11.4.8, >=12.0.0<12.0.11, >=12.1.0<12.1.2, >=12.2.0<12.2.1, >=12.3.0<12.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SuperTokens Core to a version that resolves this vulnerability.
Fixed in 12.3.1

Event History

Nov 9, 2026

CVE Published

via MITRE·06:53 PM

Data Sourced

via MITRE·06:53 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must control a login method that is linked to a primary user identity and must be able to race session creation against unlinking that login method. The attack requires low privileges and network access, but the race condition makes exploitation high complexity.

What is the impact if the race succeeds?

The attacker can retain a signed, database-backed, refreshable session for the former primary identity after their linked login method has been unlinked. That session remains valid until it expires or is explicitly revoked.

Which releases should be updated?

Affected releases begin at 7.0.0 and include versions before the fixed releases in each supported line. Update to 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, or 12.3.1, as applicable to your release line.

What can be done if an immediate update is not possible?

Explicitly revoke sessions for identities whose linked login methods are unlinked. This is necessary because a session created during the race can persist after the unlink until expiry or explicit revocation.

CVE-2026-123804: SuperTokens Core: A session created concurrently with account unlink survives the unlink

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact if the race succeeds?

Which releases should be updated?

What can be done if an immediate update is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact if the race succeeds?

Which releases should be updated?

What can be done if an immediate update is not possible?