EUVD-2026-54490
GHSA-j7vw-hh5c-2w6x
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Network-accessible API requires authenticated low-privilege access in any tenant; AC:H reflects prerequisite knowledge of target tenant identifiers; C:H captures full cross-tenant session and data exposure.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
1DescriptionCVE.org
A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of another tenant.
AnalysisAI
Tenant isolation bypass in SuperTokens Core v6.0.0 through v11.4.0 enables an authenticated user in one tenant to access sessions, data, and API endpoints belonging to separate tenants on the same instance. The flaw represents a failure of authorization enforcement at the multi-tenancy boundary layer - the core authentication service does not adequately scope API operations to the requesting tenant's namespace. No public exploit code has been identified at time of analysis, but the confidentiality impact is rated high given that cross-tenant session hijacking and user data exfiltration are within scope for a successful attacker.
Technical ContextAI
SuperTokens Core is an open-source authentication and session management backend designed to support multi-tenant SaaS architectures, providing features including session management, user authentication, and tenant-scoped user records. The affected version range (v6.0.0 to v11.4.0) encompasses the period during which multi-tenancy capabilities were active and presumably expanded. No CWE was formally assigned, but the vulnerability pattern aligns with CWE-863 (Incorrect Authorization) or CWE-284 (Improper Access Control) - specifically, the server fails to enforce that an authenticated caller in Tenant A is only authorized to access Tenant A's resources. No CPE strings were available in the provided intelligence, so affected product scope relies on the CVE description alone. The CVSS vector (AV:N/AC:H/PR:L) indicates network exploitability but with meaningful attack complexity, suggesting the flaw is not trivially triggered without knowledge of the target tenant's identifiers, session tokens, or endpoint paths.
RemediationAI
No exact patched version was confirmed from the available intelligence data - the vendor advisory at https://whitenbaker.com/supertokens-core-multitenant-advisory should be consulted immediately to identify the fixed release and upgrade SuperTokens Core accordingly. As a compensating control pending patch deployment, restrict network access to the SuperTokens Core API to trusted internal services only, preventing tenant users from directly reaching the Core API and reducing the cross-tenant attack surface; the trade-off is that this may require architecture changes in deployments where tenants interact with Core directly. Administrators should audit SuperTokens Core API access logs for anomalous cross-tenant request patterns - requests from Tenant A's session tokens targeting Tenant B's user or session endpoints - to assess whether prior exploitation occurred. Disabling multi-tenancy entirely eliminates the exposure but is likely operationally infeasible for SaaS deployments built around this feature.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today