CVE-2026-37171 in SuperTokens
Summary
by MITRE • 08/07/2026
A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of another tenant.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability represents a critical multi-tenancy security flaw in SuperTokens Core versions 6.0.0 through 11.4.0 where proper isolation between separate tenant environments has been compromised. The issue manifests as a complete breakdown in tenant separation mechanisms that allows authenticated users from one tenant to gain unauthorized access to resources, sessions, and administrative endpoints belonging to other tenants within the same SuperTokens instance. This fundamentally violates the core principle of multi-tenancy architecture where each tenant's data and operational boundaries must remain completely isolated from others.
The technical flaw stems from insufficient validation and enforcement of tenant context during authentication and authorization processes. When users authenticate through the system, the application fails to properly verify or enforce tenant boundaries, allowing session tokens and access controls to be shared or misapplied across different tenant contexts. This vulnerability can be exploited by an authenticated user who manipulates session identifiers or API requests to traverse into unauthorized tenant spaces, effectively enabling cross-tenant data leakage and potential privilege escalation.
The operational impact of this vulnerability is severe and multifaceted, encompassing data confidentiality breaches, unauthorized access to sensitive information, and potential disruption of business operations. Organizations relying on SuperTokens for identity management may experience unauthorized access to customer data, session hijacking across tenant boundaries, and complete compromise of multi-tenant isolation guarantees that are fundamental to cloud service providers and SaaS applications. Attackers could potentially access administrative controls, modify tenant configurations, or extract sensitive information from competing organizations sharing the same SuperTokens instance.
This vulnerability aligns with CWE-284 Access Control Issues and maps directly to ATT&CK technique T1078 Valid Accounts, as it exploits legitimate authenticated sessions to gain unauthorized access to additional tenant resources. The flaw also demonstrates characteristics of privilege escalation and data exposure through improper access controls, making it particularly dangerous in environments where multiple organizations share a single identity management infrastructure. Organizations should immediately implement patching procedures for SuperTokens Core versions within the affected range, conduct comprehensive security audits of existing tenant isolation mechanisms, and review all session management practices to prevent unauthorized cross-tenant access. Additionally, system administrators should consider implementing additional monitoring controls to detect anomalous access patterns that might indicate exploitation attempts against this vulnerability.