SuperTokens (Vendor): news timeline & CVEs

Top 10 Best Authentication-as-a-Service (AaaS) Providers in 2026 [Ranked & Scored]

A 2026 ranking names Auth0, Microsoft Entra External ID, and Firebase Auth the leading authentication-as-a-service providers.

Cyber Security News ranked ten authentication-as-a-service providers for 2026, scoring developer experience, security depth, and monthly-active-user pricing. Auth0, described as Okta's developer product, led with 9.2, ahead of Microsoft Entra External ID at 8.9 and Google Firebase Auth at 8.7. Amazon Cognito, Stytch, Descope, FusionAuth, Frontegg, Ping Identity, and SuperTokens completed the list. The outlet says the scores are editorial and based on documentation, pricing, and community signal rather than lab tests.

Cyber Security NewsSep 28, 06:48 UTC · 2d agoIndustry

CVE-2026-37171: SuperTokens Core cross-tenant session isolation bypass (6.0.0-11.4.0)

CVE-2026-37171: SuperTokens Core 6.0.0-11.4.0 lacks tenant separation in session operations, enabling cross-tenant access.

CVE-2026-37171 (CWE-863, Incorrect Authorization) affects SuperTokens Core, the self-hosted authentication server by SuperTokens Inc., versions 6.0.0 through 11.4.0. The Core lacks tenant separation in session operations, permitting cross-tenant authorization bypass. The CVE is published, with advisory entries NVD and GitHub GHSA-j7vw-hh5c-2w6x; the disclosure does not mention any observed exploitation.

oss-securitySep 9, 14:35 UTC · 20d agoVulnerability CVE-2026-371712

SuperTokens

Timeline2 articles

Related CVEsby mentions

Appears with

Top 10 Best Authentication-as-a-Service (AaaS) Providers in 2026 [Ranked & Scored]

CVE-2026-37171: SuperTokens Core cross-tenant session isolation bypass (6.0.0-11.4.0)