ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2026-37171

—
CVSS 3.1
5.9 medium
EPSS
<1%p16
Published
()
Modified
Description

A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of another tenant.

Weakness
CWE-863
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news

CVE-2026-37171: SuperTokens Core cross-tenant session isolation bypass (6.0.0-11.4.0)

CVE-2026-37171: SuperTokens Core 6.0.0-11.4.0 lacks tenant separation in session operations, enabling cross-tenant access.

CVE-2026-37171 (CWE-863, Incorrect Authorization) affects SuperTokens Core, the self-hosted authentication server by SuperTokens Inc., versions 6.0.0 through 11.4.0. The Core lacks tenant separation in session operations, permitting cross-tenant authorization bypass. The CVE is published, with advisory entries NVD and GitHub GHSA-j7vw-hh5c-2w6x; the disclosure does not mention any observed exploitation.

oss-security · 6d agoVulnerabilityCVE-2026-37171