Description
A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of another tenant.
Published: 2026-08-07
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

SuperTokens Core versions 6.0.0 through 11.4.0 lack proper tenant separation, allowing an authenticated user in one tenant to view and use sessions, data, and API endpoints belonging to another tenant. This results in the disclosure, modification, or execution of activities on data that the user should not be authorized to manipulate, constituting an authorization weakness (CWE‑863).

Affected Systems

SuperTokens Inc. SuperTokens Core, affected from v6.0.0 to v11.4.0.

Risk and Exploitability

The CVSS score of 5.9 indicates a moderate impact. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an authenticated user within a tenant exploiting the missing isolation to access resources of a separate tenant. Exploitation requires only valid authentication within the vulnerable tenant and no additional conditions are described.

Generated by OpenCVE AI on August 7, 2026 at 19:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a patched version of SuperTokens Core that enforces tenant isolation (e.g., v11.4.1 or later).
  • If an upgrade cannot be performed immediately, block cross‑tenant traffic with firewall or routing rules so that only authorized systems can reach tenant‑specific endpoints.
  • Activate or configure any built‑in tenant isolation options to segregate session stores and databases per tenant.

Generated by OpenCVE AI on August 7, 2026 at 19:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 07 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Title SuperTokens Core Cross-Tenant Access Vulnerability

Fri, 07 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-863
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 07 Aug 2026 16:15:00 +0000

Type Values Removed Values Added
Title SuperTokens Core Cross-Tenant Access Vulnerability

Fri, 07 Aug 2026 14:15:00 +0000

Type Values Removed Values Added
Description A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of another tenant.
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AC:H/AV:N/A:N/C:H/I:L/PR:L/S:U/UI:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-08-07T17:33:25.381Z

Reserved: 2026-04-06T00:00:00.000Z

Link: CVE-2026-37171

cve-icon Vulnrichment

Updated: 2026-08-07T17:33:15.055Z

cve-icon NVD

Status : Received

Published: 2026-08-07T14:16:59.237

Modified: 2026-08-07T18:17:13.847

Link: CVE-2026-37171

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-07T19:30:04Z

Weaknesses