https://seclists.org/oss-sec/2026/q3/692: CVE-2026-37171: SuperTokens Cocross-tenant session isolation bypass (6.0.0-11.4.0)

Q: Which deployments are exposed to cross-tenant access?

Multi-tenant SuperTokens Core deployments are exposed. The issue permits a party authenticated in one tenant to access sessions, data, and endpoints belonging to another tenant within the same Core deployment.

Q: What does an attacker need to exploit this issue?

The attacker needs a valid session and access token for one tenant in the affected SuperTokens Core deployment. They can send requests targeting another tenant while presenting an access token whose tId claim identifies their own tenant.

Q: What actions can cross-tenant requests perform?

Affected session operations include verifying, reading, regenerating, and otherwise acting on sessions, data, and endpoints in another tenant. The request is handled in the access token's tenant context rather than being rejected when the request-path tenant differs.

Published Sep 9, 2026

Updated

Affected Software

1 affected component

SuperTokens SuperTokens Core>=6.0.0<=11.4.0

Frequently Asked Questions

Which deployments are exposed to cross-tenant access?

Multi-tenant SuperTokens Core deployments are exposed. The issue permits a party authenticated in one tenant to access sessions, data, and endpoints belonging to another tenant within the same Core deployment.

What does an attacker need to exploit this issue?

The attacker needs a valid session and access token for one tenant in the affected SuperTokens Core deployment. They can send requests targeting another tenant while presenting an access token whose tId claim identifies their own tenant.

What actions can cross-tenant requests perform?

Affected session operations include verifying, reading, regenerating, and otherwise acting on sessions, data, and endpoints in another tenant. The request is handled in the access token's tenant context rather than being rejected when the request-path tenant differs.