SuperTokens Core up to 12.3.0 Session Management createNewSession race condition

Summaryinfo

A vulnerability was found in SuperTokens Core up to 12.3.0. It has been rated as critical. The impacted element is the function createNewSession of the component Session Management. This manipulation causes race condition. This vulnerability appears as CVE-2026-123804. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in SuperTokens Core up to 12.3.0 and classified as critical. Affected by this vulnerability is the function createNewSession of the component Session Management. The manipulation with an unknown input leads to a race condition vulnerability. The CWE definition for the vulnerability is CWE-362. The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated and revoked the existing sessions. A user who controls the linked login method can exploit this race to retain a signed, database-backed, refreshable session as the former primary identity after that method is unlinked; the session persists until expiry or explicit revocation. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-123804 since 11/06/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1 or 12.3.1 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• SuperTokens

Name

• Core

Version

• 10.x
• 11.0.0
• 11.0.1
• 11.0.2
• 11.0.3
• 11.0.4
• 11.0.5
• 11.0.6
• 11.0.7
• 11.0.8
• 11.1.0
• 11.1.1
• 11.1.2
• 11.1.3
• 11.2.0
• 11.2.1
• 11.2.2
• 11.2.3
• 11.3.0
• 11.3.1
• 11.3.2
• 11.3.3
• 11.3.4
• 11.3.5
• 11.3.6
• 11.3.7
• 11.4.0
• 11.4.1
• 11.4.2
• 11.4.3
• 11.4.4
• 11.4.5
• 11.4.6
• 11.4.7
• 12.0
• 12.0.0
• 12.0.1
• 12.0.2
• 12.0.3
• 12.0.4
• 12.0.5
• 12.0.6
• 12.0.7
• 12.0.8
• 12.0.9
• 12.0.10
• 12.1
• 12.1.0
• 12.1.1
• 12.2
• 12.2.0
• 12.3.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion