CVE-2026-37171

9.6 criticalEPSS 0.3%

A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of another tenant.

Severity

CVSS 3.1

9.6 critical

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-30)
CWE: CWE-863
Published: 2026-08-07
Modified: 2026-10-30
Record from: the NVD, synced 2026-10-30

Affected

supertokens:supertokens

References

https://whitenbaker.com/supertokens-core-multitenant-advisory
http://www.openwall.com/lists/oss-security/2026/09/09/4
https://whitenbaker.com/supertokens-core-multitenant-advisory/

Check your stack JSON