An unauthenticated attacker can access SuperTokens Core endpoints that use an unknown tenant path and an older CDI version to create and enumerate application roles. The flaw stems from checkIPAccess and assertThatAPIKeyCheckPasses suppressing TenantOrAppNotFoundException, while the later app‑specific handler still resolves app/public storage and the public‑tenant guard only applies to CDI versions 5.0 and later. This allows the attacker to use PUT /ghosttenant/recipe/role and GET /ghosttenant/recipe/roles without a valid API key, effectively adding privileged roles and escalating privileges within the application. The vulnerability is an authentication bypass (CWE‑288).

SuperTokens Core versions earlier than 11.3.6, 11.4.6, and 12.0.8 are vulnerable. The vendor is SuperTokens and the product is SuperTokens Core. Any deployment using an older CDI version or with the public‑tenant guard disabled is at risk. The fix is included in releases 11.3.6, 11.4.6, and 12.0.8.

The CVSS score of 7.5 denotes high severity. The EPSS score is not available, but the flaw allows unauthenticated remote exploitation over the network, so it is likely to be targeted by attackers. The issue is not listed in the CISA KEV catalog. The attack vector is remote, requiring only access to the Core endpoint; no authentication is needed.