6 matches found
CVE-2026-123802
SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, a licensed deployment with a configured SAML client can authenticate an identity from an assertion that did not satisfy the audience check. When the identity provider...
CVE-2026-123802 SuperTokens Core SAML: identity taken from an assertion that never passed the audience check, allowing sign-in as any IdP user
SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, a licensed deployment with a configured SAML client can authenticate an identity from an assertion that did not satisfy the audience check. When the identity provider...
CVE-2026-123802
SuperTokens Core , an open source authentication server, contains a vulnerability in licensed deployments using a configured SAML client (versions 11.3.0 through 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1). The root cause is a failure to properly validate the audience check in SAML asser...
EUVD-2026-120153
SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, a licensed deployment with a configured SAML client can authenticate an identity from an assertion that did not satisfy the audience check. When the identity provider...
CVE-2026-123802 SuperTokens Core SAML: identity taken from an assertion that never passed the audience check, allowing sign-in as any IdP user
SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, a licensed deployment with a configured SAML client can authenticate an identity from an assertion that did not satisfy the audience check. When the identity provider...
CVE-2026-123802: supertokens supertokens-core: SuperTokens Core is an open source authentication server
SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, a licensed deployment with a configured SAML client can authenticate an identity from an assertion that did not satisfy the audience check. When the identity provider...