The vulnerability arises when Multitenancy.checkPermissionsForCreateOrUpdate fails to enforce proper authorization for updates to a parent connection URI domain or base tenant. In a licensed multi‑tenant deployment, an attacker holding a valid API key for one application can use that key to modify the parent domain credentials, overwrite the parent API key, change sibling application keys, read or alter sibling users, and obtain sessions that act as those users. The flaw leads to full control over sibling applications, effectively bypassing isolation between tenants.

SuperTokens Core is affected in the version range 6.0.0 through 12.3.1 except where patched. Vulnerable releases include 6.0.0‑10.0.8, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1. Those releases have been fixed in the corresponding subsequent builds.

The CVSS score of 9.9 indicates that the vulnerability is critical and can be exploited by an attacker to achieve high impact. The EPSS score is not available, but the absence of a KEV listing does not diminish the risk, as privileged API keys are easily obtainable within the trusted environment. The likely attack vector is internal or through compromised API credentials; an attacker with a legitimate key can trigger the flaw without authentication beyond the API key itself. The high severity and ease of exploitation make immediate action essential.