SuperTokens Core allows any user of the configured identity provider to authenticate as any other user by exploiting an XML Signature Wrapping flaw in the SAML response validation process. The Core bypasses the required signature profile check before validating the cryptographic signature, enabling an adversary to re‑order signed elements and inject an attacker‑supplied NameID or attributes. This flaw is a direct authentication bypass (CWE‑287) and a classic XML Signature Wrapping vulnerability (CWE‑347), allowing bypass without any password. A malicious party can simply send a crafted SAML response to the Single Sign‑On endpoint and become any target user.

Affected products are SuperTokens Core, version 11.3.0 through 11.3.7, 11.4.7, and 12.0.10. The vulnerability exists in all those releases because SAML.verifySamlResponseSignature calls OpenSAML SignatureValidator.validate without first applying SAMLSignatureProfileValidator. Versions 11.3.7, 11.4.7, and 12.0.10 include the fix; any deployment of later releases is not impacted.

The CVSS score of 8.1 classifies this vulnerability as high severity. The EPSS score is not available, but the nature of the flaw suggests a realistic attack surface for any authenticated IdP user. The attack can be performed remotely by submitting a malicious SAML assertion to the SP. This vulnerability is not yet listed in the CISA KEV catalog; however, it is actively addressed by maintainers as shown in the release notes. Immediate attention and patching reduce the risk of identity‑theft or privilege abuse across all users.