SuperTokens Core between versions v7.0.0 and v12.3.1 contains a race condition that allows a user who controls a linked login method to create a new session while an unlink operation is in progress. The newly created session is saved after the unlink has already removed the login method and revoked existing sessions, leaving the attacker with a valid, refreshable session that continues to identify the user as the former primary account. Because the session persists until its natural expiration or explicit revocation, the attacker retains access to all resources that the original primary account could access. This flaw is a manifestation of a concurrency issue (CWE‑362) and missing access control (CWE‑613).

SuperTokens Core, the open source authentication server from supertokens. All releases from v7.0.0 through v12.3.1 (inclusive) are impacted, except the versions that incorporate the fix – v11.0.9, v11.1.4, v11.2.4, v11.3.8, v11.4.8, v12.0.11, v12.1.2, v12.2.1, and v12.3.1.

The vulnerability carries a CVSS score of 6.8, indicating moderate severity. No EPSS score is published, so the current exploitation probability is unclear, and it is not listed in CISA's KEV catalog. The likely attack vector involves an authenticated user who holds control of a linked login method initiating the unlink operation while concurrently creating a new session via the API. If successful, the attacker obtains a persistent session that remains valid until session timeout or explicit revocation, effectively bypassing the unlink and maintaining unauthorized access to the primary account.