SuperTokens Core up to 11.3.6/11.4.6/12.0.9 SAML Signature Verification SAML.verifySamlResponseSignature assertion

Summaryinfo

A vulnerability, which was classified as critical, was found in SuperTokens Core up to 11.3.6/11.4.6/12.0.9. Impacted is the function SAML.verifySamlResponseSignature of the component SAML Signature Verification. The manipulation results in assertion. This vulnerability was named CVE-2026-123798. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in SuperTokens Core up to 11.3.6/11.4.6/12.0.9. Affected is the function SAML.verifySamlResponseSignature of the component SAML Signature Verification. The manipulation with an unknown input leads to a assertion vulnerability. CWE is classifying the issue as CWE-617. The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.7, 11.4.7, and 12.0.10, SAML.verifySamlResponseSignature calls OpenSAML SignatureValidator.validate without first applying SAMLSignatureProfileValidator. The Core can therefore accept a cryptographically valid signature that references a different XML element from the Response or Assertion whose NameID and attributes are used for authentication. An ordinary user of the configured identity provider can move a genuinely signed element elsewhere in the document while supplying an attacker-authored identity-bearing element, causing XML Signature Wrapping authentication as another IdP user. Both response-level and assertion-level signing paths are affected, and SP-initiated login remains reachable without enabling allowIDPInitiatedLogin. This issue is fixed in versions 11.3.7, 11.4.7, and 12.0.10.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-123798 since 11/06/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Technical details are known, but there is no available exploit.

Upgrading to version 11.3.7, 11.4.7 or 12.0.10 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• SuperTokens

Name

• Core

Version

• 11.3.0
• 11.3.1
• 11.3.2
• 11.3.3
• 11.3.4
• 11.3.5
• 11.3.6
• 11.4.0
• 11.4.1
• 11.4.2
• 11.4.3
• 11.4.4
• 11.4.5
• 11.4.6
• 12.0.0
• 12.0.1
• 12.0.2
• 12.0.3
• 12.0.4
• 12.0.5
• 12.0.6
• 12.0.7
• 12.0.8
• 12.0.9

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion