GHSA-2pc4-vw9j-454c: SuperTokens Core: A session created concurrently with account unlink survives the unlink
SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated and revoked the existing sessions. A user who controls the linked login method can exploit this race to retain a signed, database-backed, refreshable session as the former primary identity after that method is unlinked; the session persists until expiry or explicit revocation. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuperTokens Coreto a version that resolves this vulnerability.Fixed in 11.0.9 - Upgrade
Upgrade
SuperTokens Coreto a version that resolves this vulnerability.Fixed in 11.1.4 - Upgrade
Upgrade
SuperTokens Coreto a version that resolves this vulnerability.Fixed in 11.2.4 - Upgrade
Upgrade
SuperTokens Coreto a version that resolves this vulnerability.Fixed in 11.3.8 - Upgrade
Upgrade
SuperTokens Coreto a version that resolves this vulnerability.Fixed in 11.4.8 - Upgrade
Upgrade
SuperTokens Coreto a version that resolves this vulnerability.Fixed in 12.0.11 - Upgrade
Upgrade
SuperTokens Coreto a version that resolves this vulnerability.Fixed in 12.1.2 - Upgrade
Upgrade
SuperTokens Coreto a version that resolves this vulnerability.Fixed in 12.2.1 - Upgrade
Upgrade
SuperTokens Coreto a version that resolves this vulnerability.Fixed in 12.3.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must control a login method that is linked to the target account and must win a race between session creation and unlinking that login method. The resulting session remains associated with the former primary identity.
Are deployments affected by default?
The issue affects SuperTokens Core versions from 7.0.0 through the releases before the listed fixed versions. It is relevant where linked login methods can be unlinked while a session can be created concurrently.
What is the impact if exploitation succeeds?
The attacker can retain a signed, database-backed, refreshable session for the former primary identity after their login method has been unlinked. That session remains valid until it expires or is explicitly revoked.
What should be done if an immediate upgrade is not possible?
Explicitly revoke sessions associated with accounts after unlinking a login method, because the surviving session persists until expiry or revocation. Upgrade to the applicable fixed release as soon as possible.
Which versions contain the fix?
Fixed versions are 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.