CVE-2026-37171

A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of another tenant.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://whitenbaker.com/supertokens-core-multitenant-advisory	Exploit Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/09/09/4	Mailing List Third Party Advisory
https://whitenbaker.com/supertokens-core-multitenant-advisory/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:supertokens:supertokens:*:*:*:*:*:*:*:*

History

30 Oct 2026, 16:33

Type	Values Removed	Values Added
First Time		Supertokens Supertokens supertokens
References	~~() https://whitenbaker.com/supertokens-core-multitenant-advisory -~~	() https://whitenbaker.com/supertokens-core-multitenant-advisory - Exploit, Third Party Advisory
References	~~() http://www.openwall.com/lists/oss-security/2026/09/09/4 -~~	() http://www.openwall.com/lists/oss-security/2026/09/09/4 - Mailing List, Third Party Advisory
References	~~() https://whitenbaker.com/supertokens-core-multitenant-advisory/ -~~	() https://whitenbaker.com/supertokens-core-multitenant-advisory/ - Exploit, Third Party Advisory
CPE		cpe:2.3:a:supertokens:supertokens::::::::

Information

Published : 2026-08-07 14:16

Updated : 2026-10-30 16:33

NVD link : CVE-2026-37171

Mitre link : CVE-2026-37171

CVE.ORG link : CVE-2026-37171

JSON object : View

Products Affected

supertokens

supertokens

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-37171", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-37171", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T17:32:36.261000Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 3.1}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-08-07T14:16:59.237", "references": [{"url": "https://whitenbaker.com/supertokens-core-multitenant-advisory", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/09/09/4", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://whitenbaker.com/supertokens-core-multitenant-advisory/", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of another tenant."}], "lastModified": "2026-10-30T16:33:15.620", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:supertokens:supertokens:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D2E011DA-B44D-4084-86ED-E48E947E310C", "versionEndIncluding": "11.4.0", "versionStartIncluding": "6.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}