Description
SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated and revoked the existing sessions. A user who controls the linked login method can exploit this race to retain a signed, database-backed, refreshable session as the former primary identity after that method is unlinked; the session persists until expiry or explicit revocation. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Published: 2026-11-09
Score: 6.8 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://github.com/supertokens/supertokens-core/commit/182b39454ac44649cdef22d87f296a38a0b1a602 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/378e1157dc26232a518d2c360ee60cf93c2fd8a2 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/5aec64aca6d765cde491658210e6922e291742fd cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/b1c569ed59fffe16c2f657da1754abcae47d2761 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/b44f1e1418206f411e541501c2e5b9b147add0d9 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/bb6d5f8d1b79770e3cc37f214ba94c3e36e9c3b8 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/c0b7f5eda20840f63f6b0f171d22bd49a7a609a1 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/c8b48e843b323cd749dcb17b6b81c190e7882a43 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/c950a01794cf0983ebd62412976cb80756bf5dd0 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/d456dfbc02f2f7d68be7c05d876bdaa086f9a5b5 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/fc273f5157d3e96f147aa42773607d627d3b495f cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/security/advisories/GHSA-2pc4-vw9j-454c cve-icon cve-icon
History

Mon, 09 Nov 2026 19:00:00 +0000

Type Values Removed Values Added
Description SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated and revoked the existing sessions. A user who controls the linked login method can exploit this race to retain a signed, database-backed, refreshable session as the former primary identity after that method is unlinked; the session persists until expiry or explicit revocation. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Title SuperTokens Core: A session created concurrently with account unlink survives the unlink
Weaknesses CWE-362
CWE-613
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-11-09T18:53:24.985Z

Reserved: 2026-11-06T15:27:56.226Z

Link: CVE-2026-123804

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-09T19:16:47.457

Modified: 2026-11-09T19:16:47.457

Link: CVE-2026-123804

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-09T22:00:15Z

Weaknesses