SuperTokens Core, an open‑source authentication server, contains a flaw in its dashboard session validation logic. The isValidUserSession function disregards the stored expiry timestamp, so the system treats a dashboard administrator’s session as valid even after the intended 30‑day lifetime has passed. Although no new session ID can be generated or guessed, any attacker who obtains a legitimate dashboard admin session token after expiration can continue to authenticate and perform full read and write actions on the dashboard until the session record is removed by cleanup or a server restart.

SuperTokens Core (the supertokens‑core product) is affected. Vulnerable releases include any version from 11.0.0 up to 12.1.2 that has not applied the patch updates posted in the v11.0.9, v11.1.4, v11.2.4, v11.3.8, v11.4.8, v12.0.11, or v12.1.2 releases.

The CVSS score of 7.4 indicates a high‑severity issue where the risk lies primarily in the continuity of unauthorized access. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation. An attacker must already possess a valid dashboard admin session id, which could arise from phishing, credential theft, or other compromise. Once acquired, the session remains usable beyond its intended expiration, allowing the attacker to maintain privileged access until the periodic cleanup removes the record or the server restarts. Because there is no mechanism to invalidate or extend expired sessions on demand, subsequent exploitation can occur silently and may remain undetected for up to twelve hours or longer if cleanup is infrequent.