CVE-2026-123801

The SuperTokens Core authentication server is vulnerable to SAML replay attacks in versions prior to 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1. The SAML.handleCallback function fails to consume RelayState , record assertion identifiers, or enforce Response.InResponseTo . This allows an ...