CVE-2026-123804
SuperTokens Core: A session created concurrently with account unlink survives the unlink
Description
SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated and revoked the existing sessions. A user who controls the linked login method can exploit this race to retain a signed, database-backed, refreshable session as the former primary identity after that method is unlinked; the session persists until expiry or explicit revocation. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
INFO
Published Date :
Nov. 9, 2026, 7:16 p.m.
Last Modified :
Nov. 9, 2026, 7:16 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-123804
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | MITRE-CVE | ||||
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update SuperTokens Core to a version including the fix.
- Verify session integrity after the update.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-123804.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-123804 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-123804
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-123804 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-123804 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by [email protected]
Nov. 09, 2026
Action Type Old Value New Value Added Description SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated and revoked the existing sessions. A user who controls the linked login method can exploit this race to retain a signed, database-backed, refreshable session as the former primary identity after that method is unlinked; the session persists until expiry or explicit revocation. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1. Added CVSS V3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Added CWE CWE-362 Added CWE CWE-613 Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/123xxx/CVE-2026-123804.json">CVE-2026-123804</a> Added Reference https://github.com/supertokens/supertokens-core/commit/182b39454ac44649cdef22d87f296a38a0b1a602 Added Reference https://github.com/supertokens/supertokens-core/commit/378e1157dc26232a518d2c360ee60cf93c2fd8a2 Added Reference https://github.com/supertokens/supertokens-core/commit/5aec64aca6d765cde491658210e6922e291742fd Added Reference https://github.com/supertokens/supertokens-core/commit/b1c569ed59fffe16c2f657da1754abcae47d2761 Added Reference https://github.com/supertokens/supertokens-core/commit/b44f1e1418206f411e541501c2e5b9b147add0d9 Added Reference https://github.com/supertokens/supertokens-core/commit/bb6d5f8d1b79770e3cc37f214ba94c3e36e9c3b8 Added Reference https://github.com/supertokens/supertokens-core/commit/c0b7f5eda20840f63f6b0f171d22bd49a7a609a1 Added Reference https://github.com/supertokens/supertokens-core/commit/c8b48e843b323cd749dcb17b6b81c190e7882a43 Added Reference https://github.com/supertokens/supertokens-core/commit/c950a01794cf0983ebd62412976cb80756bf5dd0 Added Reference https://github.com/supertokens/supertokens-core/commit/d456dfbc02f2f7d68be7c05d876bdaa086f9a5b5 Added Reference https://github.com/supertokens/supertokens-core/commit/fc273f5157d3e96f147aa42773607d627d3b495f Added Reference https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9 Added Reference https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4 Added Reference https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4 Added Reference https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8 Added Reference https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8 Added Reference https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11 Added Reference https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2 Added Reference https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1 Added Reference https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1 Added Reference https://github.com/supertokens/supertokens-core/security/advisories/GHSA-2pc4-vw9j-454c