{"affected":[{"product":"supertokens-core","source":"CNA: GitHub_M","vendor":"supertokens","versions":[{"status":"affected","version":"< 11.3.6"},{"status":"affected","version":">= 11.4.0, < 11.4.6"},{"status":"affected","version":">= 12.0.6, < 12.0.8"}]}],"cveId":"CVE-2026-123797","cwes":["CWE-288"],"description":"SuperTokens Core is an open source authentication server. Prior to 11.3.6, 11.4.6, and 12.0.8, app-specific management requests using an unknown tenant path and an older supported cdi-version can bypass API-key and public-tenant enforcement. In src/main/java/io/supertokens/webserver/WebserverAPI.java, checkIPAccess and assertThatAPIKeyCheckPasses suppress TenantOrAppNotFoundException, while the later app-specific handler resolves app/public storage and the public-tenant guard applies only to CDI versions 5.0 and later. An unauthenticated caller able to reach the Core endpoint can therefore use PUT /ghosttenant/recipe/role and GET /ghosttenant/recipe/roles to create and enumerate application roles without a valid API key. This issue is fixed in versions 11.3.6, 11.4.6, and 12.0.8.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"}],"modifiedAt":1794247165028,"publishedAt":1794246774576,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/supertokens/supertokens-core/security/advisories/GHSA-q7mc-f2jm-r4gr"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/commit/1bad648d7b77aca058cb6bf75373455bacc4e537"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/commit/5811a10190b1d4d8d7a9fe2e17cb49437e6ffa49"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/commit/7ce22db2b6ba95d7666adc51bb9ee60ac7d3d198"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.3.6"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.4.6"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.0.8"}],"remediation":[],"revision":"8ee4e6fa1fc709e37fd042914864550095707706cdeef2315a2e84ade6d2db89","sources":[{"modifiedAt":1794247165028,"name":"CNA: GitHub_M","retrievedAt":1794247838034,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123797"}],"ssvc":null,"status":"published","title":"SuperTokens Core: Unknown tenant path bypasses API key and public-tenant enforcement","updatedAt":1794247838034}