CVE-2026-123802 SuperTokens Core SAML: identity taken from an assertion that never passed the audience check, allowing sign-in as any IdP user

SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, a licensed deployment with a configured SAML client can authenticate an identity from an assertion that did not satisfy the audience check. When the identity provider...

CVE-2026-123802 SuperTokens Core SAML: identity taken from an assertion that never passed the audience check, allowing sign-in as any IdP user

SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, a licensed deployment with a configured SAML client can authenticate an identity from an assertion that did not satisfy the audience check. When the identity provider...