{"affected":[{"product":"supertokens-core","source":"CNA: GitHub_M","vendor":"supertokens","versions":[{"status":"affected","version":">= 10.1.0, < 11.0.0"},{"status":"affected","version":">= 11.0.0, < 11.0.9"},{"status":"affected","version":">= 11.1.0, < 11.1.4"},{"status":"affected","version":">= 11.2.0, < 11.2.4"},{"status":"affected","version":">= 11.3.0, < 11.3.8"},{"status":"affected","version":">= 11.4.0, < 11.4.8"},{"status":"affected","version":">= 12.0.0, < 12.0.11"},{"status":"affected","version":">= 12.1.0, < 12.1.2"},{"status":"affected","version":">= 12.2.0, < 12.2.1"},{"status":"affected","version":">= 12.3.0, < 12.3.1"}]}],"cveId":"CVE-2026-123803","cwes":["CWE-863","CWE-1220"],"description":"SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform application-scoped WebAuthn lookups without constraining them to the requested tenant, and WebAuthN.signIn does not verify tenant membership. In a multi-tenant deployment using WebAuthn with a shared user pool, an ordinary user who possesses their own valid passkey in one tenant can submit its assertion to another tenant's sign-in endpoint in the same application and be authenticated there despite having no membership in the target tenant. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.1,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},{"score":8.1,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1794266236690,"publishedAt":1794250131355,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/supertokens/supertokens-core/security/advisories/GHSA-6v34-w48w-44rc"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/commit/01ca34a06baa0d22db008f38c8eabd1f6695d9a6"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/commit/030643edea5d69e0009ceeecbc5dd70be5c66186"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/commit/1e3e4d9b25237a9c8fd77cbe0d4d0ecb360d8cd6"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/commit/84492e38f9eb6db0cc338674ce5e94d1603bef08"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/commit/982d420a5ac29d5e362eaf39169a7a9f5339abeb"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/commit/a3d033022effb00ccf0c4ec6ca77c36eb1a24617"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/commit/ad768c1925e245930e5fbf9441452d85564de91d"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/commit/b933b6c9b4495e47a8b3efeb5a70e9d014777320"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/commit/e19d173f47658d036685d3020e18819c5f3690b7"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/supertokens/supertokens-core/commit/01ca34a06baa0d22db008f38c8eabd1f6695d9a6"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/supertokens/supertokens-core/commit/030643edea5d69e0009ceeecbc5dd70be5c66186"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/supertokens/supertokens-core/commit/1e3e4d9b25237a9c8fd77cbe0d4d0ecb360d8cd6"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/supertokens/supertokens-core/commit/84492e38f9eb6db0cc338674ce5e94d1603bef08"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/supertokens/supertokens-core/commit/982d420a5ac29d5e362eaf39169a7a9f5339abeb"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/supertokens/supertokens-core/commit/a3d033022effb00ccf0c4ec6ca77c36eb1a24617"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/supertokens/supertokens-core/commit/ad768c1925e245930e5fbf9441452d85564de91d"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/supertokens/supertokens-core/commit/b933b6c9b4495e47a8b3efeb5a70e9d014777320"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/supertokens/supertokens-core/commit/e19d173f47658d036685d3020e18819c5f3690b7"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/supertokens/supertokens-core/security/advisories/GHSA-6v34-w48w-44rc"}],"remediation":[],"revision":"b8685f428100509e2ba432cec698193ea09d964ce0d3687b4426643df12ecfc4","sources":[{"modifiedAt":1794265271131,"name":"CNA: GitHub_M","retrievedAt":1794269309410,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123803"},{"modifiedAt":1794266236690,"name":"NVD","retrievedAt":1794269958075,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123803"}],"ssvc":{"assessedAt":1794265235473,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"SuperTokens Core: WebAuthn sign-in accepts a passkey across tenant boundaries","updatedAt":1794269958075}