GHSA-6v34-w48w-44rc: SuperTokens Core: WebAuthn sign-in accepts a passkey across tenant boundaries
SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsByIdTransaction and getUserInfoByCredentialIdTransaction perform application-scoped WebAuthn lookups without constraining them to the requested tenant, and WebAuthN.signIn does not verify tenant membership. In a multi-tenant deployment using WebAuthn with a shared user pool, an ordinary user who possesses their own valid passkey in one tenant can submit its assertion to another tenant's sign-in endpoint in the same application and be authenticated there despite having no membership in the target tenant. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuperTokens Coreto a version that resolves this vulnerability.Fixed in 11.0.9 - Upgrade
Upgrade
SuperTokens Coreto a version that resolves this vulnerability.Fixed in 11.1.4 - Upgrade
Upgrade
SuperTokens Coreto a version that resolves this vulnerability.Fixed in 11.2.4 - Upgrade
Upgrade
SuperTokens Coreto a version that resolves this vulnerability.Fixed in 11.3.8 - Upgrade
Upgrade
SuperTokens Coreto a version that resolves this vulnerability.Fixed in 11.4.8 - Upgrade
Upgrade
SuperTokens Coreto a version that resolves this vulnerability.Fixed in 12.0.11 - Upgrade
Upgrade
SuperTokens Coreto a version that resolves this vulnerability.Fixed in 12.1.2 - Upgrade
Upgrade
SuperTokens Coreto a version that resolves this vulnerability.Fixed in 12.2.1 - Upgrade
Upgrade
SuperTokens Coreto a version that resolves this vulnerability.Fixed in 12.3.1
Event History
Frequently Asked Questions
Which deployments are exposed to cross-tenant sign-in?
The issue affects multi-tenant deployments that use WebAuthn with a shared user pool. A user must have a valid passkey in one tenant and be able to submit an assertion to another tenant's sign-in endpoint within the same application.
Does an attacker need elevated privileges or interaction from another user?
No. An ordinary authenticated user with their own valid passkey can exploit the issue, and no user interaction is required.
Which versions contain the fix?
Fixed versions are 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.