CVE-2026-37171: SuperTokens Core cross-tenant session isolation bypass (6.0.0-11.4.0)
CVE-2026-37171: SuperTokens Core 6.0.0-11.4.0 lacks tenant separation in session operations, enabling cross-tenant access.
CVE-2026-37171 (CWE-863, Incorrect Authorization) affects SuperTokens Core, the self-hosted authentication server by SuperTokens Inc., versions 6.0.0 through 11.4.0. The Core lacks tenant separation in session operations, permitting cross-tenant authorization bypass. The CVE is published, with advisory entries NVD and GitHub GHSA-j7vw-hh5c-2w6x; the disclosure does not mention any observed exploitation.
- Cross-tenant authorization flaw (CWE-863) in session operations
- Affects SuperTokens Core versions 6.0.0 through 11.4.0
- Tracked as GHSA-j7vw-hh5c-2w6x on GitHub
- CVEs
- CVE-2026-37171
- Vendors
- SuperTokens
- Products
- SuperTokens Core
- Organizations
- SuperTokens Inc.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-37171 | A lack of tenant separation in SuperTokens Inc | 9.6 | <1% | PoC ×2 |
From the original article
Posted by Mr. Gatto on Sep 09 Hello, This is a disclosure for CVE-2026-37171, a cross-tenant authorization flaw in SuperTokens Core, the self-hosted authentication server by SuperTokens Inc. Affected: SuperTokens Core (supertokens-core) versions 6.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.