GHSA-q7mc-f2jm-r4gr: SuperTokens Core: Unknown tenant path bypasses API key and public-tenant enforcement

Q: Which deployments are exposed?

SuperTokens Core versions before 11.3.6, 11.4.6, and 12.0.8 are affected when an attacker can reach the Core endpoint. Exploitation also depends on use of an older supported CDI version, because the public-tenant guard applies only to CDI 5.0 and later.

Q: What does an attacker need to exploit this issue?

The attacker does not need authentication, a valid API key, or user interaction. They need network access to the Core endpoint and can use an unknown tenant path with affected app-specific management requests.

Q: What can an attacker do through the bypass?

An attacker can create application roles with PUT /ghosttenant/recipe/role and enumerate roles with GET /ghosttenant/recipe/roles. These requests can bypass API-key and public-tenant enforcement under the affected conditions.

Q: What should be done if an immediate upgrade is not possible?

Restrict unauthenticated network access to the SuperTokens Core endpoint, since reachability of that endpoint is required for exploitation. Upgrade to 11.3.6, 11.4.6, or 12.0.8 when possible.

Published Nov 9, 2026

Updated

SuperTokens Core is an open source authentication server. Prior to 11.3.6, 11.4.6, and 12.0.8, app-specific management requests using an unknown tenant path and an older supported cdi-version can bypass API-key and public-tenant enforcement. In src/main/java/io/supertokens/webserver/WebserverAPI.java, checkIPAccess and assertThatAPIKeyCheckPasses suppress TenantOrAppNotFoundException, while the later app-specific handler resolves app/public storage and the public-tenant guard applies only to CDI versions 5.0 and later. An unauthenticated caller able to reach the Core endpoint can therefore use PUT /ghosttenant/recipe/role and GET /ghosttenant/recipe/roles to create and enumerate application roles without a valid API key. This issue is fixed in versions 11.3.6, 11.4.6, and 12.0.8.

Affected Software

1 affected component

SuperTokens Core<11.3.6, <11.4.6, <12.0.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SuperTokens Core to a version that resolves this vulnerability.
Fixed in 11.3.6
Upgrade
Upgrade SuperTokens Core to a version that resolves this vulnerability.
Fixed in 11.4.6
Upgrade
Upgrade SuperTokens Core to a version that resolves this vulnerability.
Fixed in 12.0.8

Event History

Nov 9, 2026

CVE Published

via OSV·05:52 PM

Data Sourced

via OSV·05:52 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

SuperTokens Core versions before 11.3.6, 11.4.6, and 12.0.8 are affected when an attacker can reach the Core endpoint. Exploitation also depends on use of an older supported CDI version, because the public-tenant guard applies only to CDI 5.0 and later.

What does an attacker need to exploit this issue?

The attacker does not need authentication, a valid API key, or user interaction. They need network access to the Core endpoint and can use an unknown tenant path with affected app-specific management requests.

What can an attacker do through the bypass?

An attacker can create application roles with PUT /ghosttenant/recipe/role and enumerate roles with GET /ghosttenant/recipe/roles. These requests can bypass API-key and public-tenant enforcement under the affected conditions.

What should be done if an immediate upgrade is not possible?

Restrict unauthenticated network access to the SuperTokens Core endpoint, since reachability of that endpoint is required for exploitation. Upgrade to 11.3.6, 11.4.6, or 12.0.8 when possible.

GHSA-q7mc-f2jm-r4gr: SuperTokens Core: Unknown tenant path bypasses API key and public-tenant enforcement

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What can an attacker do through the bypass?

What should be done if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What can an attacker do through the bypass?

What should be done if an immediate upgrade is not possible?