CVE-2026-123802 SuperTokens Core SAML: identity taken from an assertion that never passed the audience check, allowing sign-in as any IdP user

[
  {
    "vendor": "supertokens",
    "product": "supertokens-core",
    "versions": [
      {
        "version": ">= 11.3.0, < 11.3.8",
        "status": "affected"
      },
      {
        "version": ">= 11.4.0, < 11.4.8",
        "status": "affected"
      },
      {
        "version": ">= 12.0.0, < 12.0.11",
        "status": "affected"
      },
      {
        "version": ">= 12.1.0, < 12.1.2",
        "status": "affected"
      },
      {
        "version": ">= 12.2.0, < 12.2.1",
        "status": "affected"
      },
      {
        "version": ">= 12.3.0, < 12.3.1",
        "status": "affected"
      }
    ]
  }
]