supertokens-core
v12.5.0Open source alternative to Auth0 / Firebase Auth / AWS Cognito
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- OtherUnknown
- Security
- 27 advisories1 critical, 15 high, 9 medium, 2 low · Scorecard 5.0/10
- Supported versions
- No scheduleendoflife.date does not track this project
15.3k stars · 778 forks · 158 open issues · last release 9 days ago · data checked 5 hours ago
Security advisories
All advisories on GitHubThe 27 most recent advisories published by the maintainers: 1 critical, 15 high, 9 medium, 2 low. Check the patched version against the one you run.
- highGHSA-hqvg-896m-p9q6Nov 9, 2026OAuth client endpoints did not check that a client belongs to the calling app, so one app's API key could revoke tokens of, rewrite or delete another app's OAuth client
- Affected
- >= 9.3.0, < 11.0.0; >= 11.0.0, < 11.0.10; >= 11.1.0, < 11.1.5; >= 11.2.0, < 11.2.5; >= 11.3.0, < 11.3.9; >= 11.4.0, < 11.4.9; >= 12.0.0, < 12.0.12; >= 12.1.0, < 12.1.3; >= 12.2.0, < 12.2.2; >= 12.3.0, < 12.3.2; >= 12.4.0, < 12.4.2
- Patched in
- 11.0.10; 11.1.5; 11.2.5; 11.3.9; 11.4.9; 12.0.12; 12.1.3; 12.2.2; 12.3.2; 12.4.2
- mediumGHSA-8q27-96vx-r652Nov 9, 2026API key and IP checks were skipped for a request under an appId that does not exist, revealing which appIds exist
- Affected
- >= 6.0.23, < 6.0.25; >= 8.0.6, < 8.0.8; >= 9.0.5, < 9.0.7; >= 9.1.0, < 9.1.7; >= 9.2.0, < 9.2.8; >= 9.3.0, < 9.3.6; >= 10.0.0, < 10.0.9; >= 10.1.0, < 10.1.10; >= 11.0.0, < 11.0.10; >= 11.1.0, < 11.1.5; >= 11.2.0, < 11.2.5; >= 11.3.0, < 11.3.9; >= 11.4.0, < 11.4.9; >= 12.0.0, < 12.0.12; >= 12.1.0, <
- Patched in
- 6.0.25; 8.0.8; 9.0.7; 9.1.7; 9.2.8; 9.3.6; 10.0.9; 10.1.10; 11.0.10; 11.1.5; 11.2.5; 11.3.9; 11.4.9; 12.0.12; 12.1.3; 12.2.2; 12.3.2; 12.4.2
- highGHSA-m734-pwcf-jp9xNov 9, 2026OAuth2 login and consent accept/reject endpoints did not check that the request belongs to the calling app's OAuth client, allowing cross-app impersonation and denial of service
- Affected
- >= 9.3.0, < 11.0.0; >= 11.0.0, < 11.0.10; >= 11.1.0, < 11.1.5; >= 11.2.0, < 11.2.5; >= 11.3.0, < 11.3.9; >= 11.4.0, < 11.4.9; >= 12.0.0, < 12.0.12; >= 12.1.0, < 12.1.3; >= 12.2.0, < 12.2.2; >= 12.3.0, < 12.3.2; >= 12.4.0, < 12.4.2
- Patched in
- 11.0.10; 11.1.5; 11.2.5; 11.3.9; 11.4.9; 12.0.12; 12.1.3; 12.2.2; 12.3.2; 12.4.2
- highGHSA-rccr-fgjm-5vj6Nov 9, 2026SAML replay protection (GHSA-3r7x) bypass: an assertion without Conditions@NotOnOrAfter is accepted again after its consumed record is purged
- Affected
- >= 11.3.0, < 11.3.9; >= 11.4.0, < 11.4.9; >= 12.0.0, < 12.0.12; >= 12.1.0, < 12.1.3; >= 12.2.0, < 12.2.2; >= 12.3.0, < 12.3.2; >= 12.4.0, < 12.4.2
- Patched in
- 11.3.9; 11.4.9; 12.0.12; 12.1.3; 12.2.2; 12.3.2; 12.4.2
- mediumGHSA-xf2m-rvh2-qphfNov 9, 2026Legacy SAML token endpoint did not check the authorization code, so a leaked code could be redeemed for the user's SAML claims without the client secret
- Affected
- >= 11.3.0, < 11.3.9; >= 11.4.0, < 11.4.9; >= 12.0.0, < 12.0.12; >= 12.1.0, < 12.1.3; >= 12.2.0, < 12.2.2; >= 12.3.0, < 12.3.2; >= 12.4.0, < 12.4.2
- Patched in
- 11.3.9; 11.4.9; 12.0.12; 12.1.3; 12.2.2; 12.3.2; 12.4.2
- lowGHSA-4ppr-m64c-mjv3Nov 9, 2026WebAuthn account-recovery API resolved the target user by app instead of tenant, so an API-key holder could issue a recovery token through another tenant
- Affected
- >= 10.1.0, < 11.0.0; >= 11.0.0, < 11.0.10; >= 11.1.0, < 11.1.5; >= 11.2.0, < 11.2.5; >= 11.3.0, < 11.3.9; >= 11.4.0, < 11.4.9; >= 12.0.0, < 12.0.12; >= 12.1.0, < 12.1.3; >= 12.2.0, < 12.2.2; >= 12.3.0, < 12.3.2; >= 12.4.0, < 12.4.2
- Patched in
- 11.0.10; 11.1.5; 11.2.5; 11.3.9; 11.4.9; 12.0.12; 12.1.3; 12.2.2; 12.3.2; 12.4.2
- mediumGHSA-v546-3qmg-crjxNov 9, 2026WebAuthn sign-in options can be consumed by two concurrent sign-ins: the same assertion signs in twice
- Affected
- >= 12.0.8, < 12.0.12; >= 12.1.0, < 12.1.3; >= 12.2.0, < 12.2.2; >= 12.3.0, < 12.3.2; >= 12.4.0, < 12.4.2
- Patched in
- 12.0.12; 12.1.3; 12.2.2; 12.3.2; 12.4.2
- highGHSA-wqq3-fv92-4r77Nov 9, 2026Dashboard core-config API returns the database password, the connection URI credentials and the Firebase signer key to any dashboard user
- Affected
- >= 9.1.0, < 11.0.0; >= 11.0.0, < 11.0.10; >= 11.1.0, < 11.1.5; >= 11.2.0, < 11.2.5; >= 11.3.0, < 11.3.9; >= 11.4.0, < 11.4.9; >= 12.0.0, < 12.0.12; >= 12.1.0, < 12.1.3; >= 12.2.0, < 12.2.2; >= 12.3.0, < 12.3.2; >= 12.4.0, < 12.4.2
- Patched in
- 11.0.10; 11.1.5; 11.2.5; 11.3.9; 11.4.9; 12.0.12; 12.1.3; 12.2.2; 12.3.2; 12.4.2
- highGHSA-j2gj-xm95-8ggfNov 9, 2026TOTP verification: concurrent and cross-tenant requests bypass replay protection and the attempt limit, and device verification skips the code check
- Affected
- >= 4.5.0, < 11.0.0; >= 11.0.0, < 11.0.10; >= 11.1.0, < 11.1.5; >= 11.2.0, < 11.2.5; >= 11.3.0, < 11.3.9; >= 11.4.0, < 11.4.9; >= 12.0.0, < 12.0.12; >= 12.1.0, < 12.1.3; >= 12.2.0, < 12.2.2; >= 12.3.0, < 12.3.2; >= 12.4.0, < 12.4.2
- Patched in
- 11.0.10; 11.1.5; 11.2.5; 11.3.9; 11.4.9; 12.0.12; 12.1.3; 12.2.2; 12.3.2; 12.4.2
- mediumGHSA-4jp4-pv69-8pj9Nov 9, 2026Password reset tokens and sessions outlive the email, password and login-method changes meant to end them
- Affected
- >= 3.5.0, < 11.0.0; >= 11.0.0, < 11.0.10; >= 11.1.0, < 11.1.5; >= 11.2.0, < 11.2.5; >= 11.3.0, < 11.3.9; >= 11.4.0, < 11.4.9; >= 12.0.0, < 12.0.12; >= 12.1.0, < 12.1.3; >= 12.2.0, < 12.2.2; >= 12.3.0, < 12.3.2; >= 12.4.0, < 12.4.2
- Patched in
- 11.0.10; 11.1.5; 11.2.5; 11.3.9; 11.4.9; 12.0.12; 12.1.3; 12.2.2; 12.3.2; 12.4.2
- mediumGHSA-2w87-q3mm-f3v2Nov 9, 2026Email-password sign-up auto-verifies another user's placeholder email, enabling account takeover through account linking
- Affected
- >= 9.0.0, < 11.0.0; >= 11.0.0, < 11.0.10; >= 11.1.0, < 11.1.5; >= 11.2.0, < 11.2.5; >= 11.3.0, < 11.3.9; >= 11.4.0, < 11.4.9; >= 12.0.0, < 12.0.12; >= 12.1.0, < 12.1.3; >= 12.2.0, < 12.2.2; >= 12.3.0, < 12.3.2; >= 12.4.0, < 12.4.2
- Patched in
- 11.0.10; 11.1.5; 11.2.5; 11.3.9; 11.4.9; 12.0.12; 12.1.3; 12.2.2; 12.3.2; 12.4.2
- highGHSA-9mv6-rgp8-qc98Nov 9, 2026Deprecated CDI 5.0 tenant updates can turn a required secondary factor into a first factor, allowing single-factor sign-in
- Affected
- >= 9.1.0, < 11.0.0; >= 11.0.0, < 11.0.10; >= 11.1.0, < 11.1.5; >= 11.2.0, < 11.2.5; >= 11.3.0, < 11.3.9; >= 11.4.0, < 11.4.9; >= 12.0.0, < 12.0.12; >= 12.1.0, < 12.1.3; >= 12.2.0, < 12.2.2; >= 12.3.0, < 12.3.2; >= 12.4.0, < 12.4.2
- Patched in
- 11.0.10; 11.1.5; 11.2.5; 11.3.9; 11.4.9; 12.0.12; 12.1.3; 12.2.2; 12.3.2; 12.4.2
- highGHSA-qq3r-g9v7-4853Nov 9, 2026Third-party sign-in can rewrite another tenant's user's email and mark an email verified that the provider did not vouch for
- Affected
- >= 7.0.0, < 11.0.0; >= 11.0.0, < 11.0.10; >= 11.1.0, < 11.1.5; >= 11.2.0, < 11.2.5; >= 11.3.0, < 11.3.9; >= 11.4.0, < 11.4.9; >= 12.0.0, < 12.0.12; >= 12.1.0, < 12.1.3; >= 12.2.0, < 12.2.2; >= 12.3.0, < 12.3.2; >= 12.4.0, < 12.4.2
- Patched in
- 11.0.10; 11.1.5; 11.2.5; 11.3.9; 11.4.9; 12.0.12; 12.1.3; 12.2.2; 12.3.2; 12.4.2
- mediumGHSA-hg2v-c5hc-6822Nov 9, 2026WebAuthn: credential ids not bound to the attestation, sign-in user resolved separately from the verifying key, and the user id leaked in register options
- Affected
- >= 10.1.0, < 11.0.0; >= 11.0.0, < 11.0.10; >= 11.1.0, < 11.1.5; >= 11.2.0, < 11.2.5; >= 11.3.0, < 11.3.9; >= 11.4.0, < 11.4.9; >= 12.0.0, < 12.0.12; >= 12.1.0, < 12.1.3; >= 12.2.0, < 12.2.2; >= 12.3.0, < 12.3.2; >= 12.4.0, < 12.4.2
- Patched in
- 11.0.10; 11.1.5; 11.2.5; 11.3.9; 11.4.9; 12.0.12; 12.1.3; 12.2.2; 12.3.2; 12.4.2
- mediumGHSA-p8xx-gvr9-52wqNov 9, 2026Dashboard and email-password sign-in reveal whether an email has an account through response timing and the dashboard suspension status
- Affected
- >= 3.0.0, < 11.0.0; >= 11.0.0, < 11.0.10; >= 11.1.0, < 11.1.5; >= 11.2.0, < 11.2.5; >= 11.3.0, < 11.3.9; >= 11.4.0, < 11.4.9; >= 12.0.0, < 12.0.12; >= 12.1.0, < 12.1.3; >= 12.2.0, < 12.2.2; >= 12.3.0, < 12.3.2; >= 12.4.0, < 12.4.2
- Patched in
- 11.0.10; 11.1.5; 11.2.5; 11.3.9; 11.4.9; 12.0.12; 12.1.3; 12.2.2; 12.3.2; 12.4.2
- lowGHSA-vw3m-mqr7-wgvfNov 9, 2026Account linking in PostgreSQL LEGACY migration mode: concurrent requests can create two primary users with the same email
- Affected
- >= 12.0.0, < 12.0.12; >= 12.1.0, < 12.1.3; >= 12.2.0, < 12.2.2; >= 12.3.0, < 12.3.2; >= 12.4.0, < 12.4.2
- Patched in
- 12.0.12; 12.1.3; 12.2.2; 12.3.2; 12.4.2
- mediumGHSA-4gh4-865v-mvp9Nov 9, 2026Bulk import error messages contain imported users' passwords, password hashes and TOTP secrets, which are logged and stored
- Affected
- >= 10.0.0, < 11.0.0; >= 11.0.0, < 11.0.10; >= 11.1.0, < 11.1.5; >= 11.2.0, < 11.2.5; >= 11.3.0, < 11.3.9; >= 11.4.0, < 11.4.9; >= 12.0.0, < 12.0.12; >= 12.1.0, < 12.1.3; >= 12.2.0, < 12.2.2; >= 12.3.0, < 12.3.2; >= 12.4.0, < 12.4.2
- Patched in
- 11.0.10; 11.1.5; 11.2.5; 11.3.9; 11.4.9; 12.0.12; 12.1.3; 12.2.2; 12.3.2; 12.4.2
- highGHSA-gwhx-68r6-qm37Nov 9, 2026OpenTelemetry method spans export the core configuration, including database credentials and API keys, when the core runs with the Java agent
- Affected
- >= 11.2.0, < 11.2.5; >= 11.3.0, < 11.3.9; >= 11.4.0, < 11.4.9; >= 12.0.0, < 12.0.12; >= 12.1.0, < 12.1.3; >= 12.2.0, < 12.2.2; >= 12.3.0, < 12.3.2; >= 12.4.0, < 12.4.2
- Patched in
- 11.2.5; 11.3.9; 11.4.9; 12.0.12; 12.1.3; 12.2.2; 12.3.2; 12.4.2
- highGHSA-rg6v-28j6-7rj9Nov 9, 2026API-key and IP checks are skipped for an existing app while the core refreshes its tenant list, allowing unauthenticated requests
- Affected
- >= 6.0.23, < 6.0.25; >= 8.0.6, < 8.0.8; >= 9.0.5, < 9.0.7; >= 9.1.0, < 9.1.7; >= 9.2.0, < 9.2.8; >= 9.3.0, < 9.3.6; >= 10.0.0, < 10.0.9; >= 10.1.0, < 10.1.10; >= 11.0.0, < 11.0.10; >= 11.1.0, < 11.1.5; >= 11.2.0, < 11.2.5; >= 11.3.0, < 11.3.9; >= 11.4.0, < 11.4.9; >= 12.0.0, < 12.0.12; >= 12.1.0, <
- Patched in
- 6.0.25; 8.0.8; 9.0.7; 9.1.7; 9.2.8; 9.3.6; 10.0.9; 10.1.10; 11.0.10; 11.1.5; 11.2.5; 11.3.9; 11.4.9; 12.0.12; 12.1.3; 12.2.2; 12.3.2; 12.4.2
- mediumCVE-2026-123804Oct 16, 2026A session created concurrently with account unlink survives the unlink
- Affected
- >= 7.0.0, < 11.0.0; >= 11.0.0, < 11.0.9; >= 11.1.0, < 11.1.4; >= 11.2.0, < 11.2.4; >= 11.3.0, < 11.3.8; >= 11.4.0, < 11.4.8; >= 12.0.0, < 12.0.11; >= 12.1.0, < 12.1.2; >= 12.2.0, < 12.2.1; >= 12.3.0, < 12.3.1
- Patched in
- 11.0.9; 11.1.4; 11.2.4; 11.3.8; 11.4.8; 12.0.11; 12.1.2; 12.2.1; 12.3.1
- highCVE-2026-123802Oct 16, 2026SAML: identity taken from an assertion that never passed the audience check, allowing sign-in as any IdP user
- Affected
- >= 11.3.0, < 11.3.8; >= 11.4.0, < 11.4.8; >= 12.0.0, < 12.0.11; >= 12.1.0, < 12.1.2; >= 12.2.0, < 12.2.1; >= 12.3.0, < 12.3.1
- Patched in
- 11.3.8; 11.4.8; 12.0.11; 12.1.2; 12.2.1; 12.3.1
- highCVE-2026-123801Oct 16, 2026SAML callback accepts a replayed RelayState + SAMLResponse, minting a fresh authorization code on each replay
- Affected
- >= 11.3.0, < 11.3.8; >= 11.4.0, < 11.4.8; >= 12.0.0, < 12.0.11; >= 12.1.0, < 12.1.2; >= 12.2.0, < 12.2.1; >= 12.3.0, < 12.3.1
- Patched in
- 11.3.8; 11.4.8; 12.0.11; 12.1.2; 12.2.1; 12.3.1
- criticalCVE-2026-123800Oct 16, 2026App-scoped API key can overwrite the parent connection URI domain's credentials and take over sibling applications
- Affected
- >= 6.0.0, < 6.0.24; >= 7.0.0, < 7.0.23; >= 8.0.0, < 8.0.7; >= 9.0.0, < 9.0.6; >= 9.1.0, < 9.1.6; >= 9.2.0, < 9.2.7; >= 9.3.0, < 9.3.5; >= 10.0.0, < 10.0.8; >= 10.1.0, < 10.1.9; >= 11.0.0, < 11.0.9; >= 11.1.0, < 11.1.4; >= 11.2.0, < 11.2.4; >= 11.3.0, < 11.3.8; >= 11.4.0, < 11.4.8; >= 12.0.0, < 12.0.
- Patched in
- 6.0.24; 7.0.23; 8.0.7; 9.0.6; 9.1.6; 9.2.7; 9.3.5; 10.0.8; 10.1.9; 11.0.9; 11.1.4; 11.2.4; 11.3.8; 11.4.8; 12.0.11; 12.1.2; 12.2.1; 12.3.1
- highCVE-2026-123797Oct 16, 2026Unknown tenant path bypasses API key and public-tenant enforcement in SuperTokens Core
- Affected
- >=12.0.6, <12.0.8; >=11.4.0, <11.4.6; >=11.3.0, <11.3.6; <11.3.0
- Patched in
- 12.0.8, 11.4.6, 11.3.6
- highCVE-2026-123798Oct 16, 2026SAML XML Signature Wrapping authentication bypass — any IdP user can authenticate as any other user
- Affected
- >= 12.0.6, < 12.0.10; >= 11.4.0, < 11.4.7; >= 11.3.0, < 11.3.7
- Patched in
- 12.0.10; 11.4.7; 11.3.7
- highCVE-2026-123799Oct 16, 2026Dashboard session tokens are never checked for expiry: `isValidUserSession` ignores the stored `expiry`, so a long-expired admin session still authenticates
- Affected
- >= 11.0.0, < 11.0.9; >= 11.1.0, < 11.1.4; >= 11.2.0, < 11.2.4; >= 11.3.0, < 11.3.8; >= 11.4.0, < 11.4.8; >= 12.0.0, < 12.0.11; >= 12.1.0, < 12.1.2
- Patched in
- 11.0.9; 11.1.4; 11.2.4; 11.3.8; 11.4.8; 12.0.11; 12.1.2
- highCVE-2026-123803Oct 16, 2026WebAuthn sign-in accepts a passkey across tenant boundaries
- Affected
- >= 10.1.0, < 11.0.0; >= 11.0.0, < 11.0.9; >= 11.1.0, < 11.1.4; >= 11.2.0, < 11.2.4; >= 11.3.0, < 11.3.8; >= 11.4.0, < 11.4.8; >= 12.0.0, < 12.0.11; >= 12.1.0, < 12.1.2; >= 12.2.0, < 12.2.1; >= 12.3.0, < 12.3.1
- Patched in
- 11.0.9; 11.1.4; 11.2.4; 11.3.8; 11.4.8; 12.0.11; 12.1.2; 12.2.1; 12.3.1