SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated and revoked the existing sessions. A user who controls the linked login method can exploit this race to retain a signed, database-backed, refreshable session as the former primary identity after that method is unlinked; the session persists until expiry or explicit revocation. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

No data.

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/supertokens/supertokens-core/commit/182b39454ac44649cdef22d87f296a38a0b1a602 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/378e1157dc26232a518d2c360ee60cf93c2fd8a2 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/5aec64aca6d765cde491658210e6922e291742fd cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/b1c569ed59fffe16c2f657da1754abcae47d2761 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/b44f1e1418206f411e541501c2e5b9b147add0d9 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/bb6d5f8d1b79770e3cc37f214ba94c3e36e9c3b8 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/c0b7f5eda20840f63f6b0f171d22bd49a7a609a1 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/c8b48e843b323cd749dcb17b6b81c190e7882a43 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/c950a01794cf0983ebd62412976cb80756bf5dd0 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/d456dfbc02f2f7d68be7c05d876bdaa086f9a5b5 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/commit/fc273f5157d3e96f147aa42773607d627d3b495f cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1 cve-icon cve-icon
https://github.com/supertokens/supertokens-core/security/advisories/GHSA-2pc4-vw9j-454c cve-icon cve-icon
History

Mon, 09 Nov 2026 19:00:00 +0000

Type Values Removed Values Added
Description SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated and revoked the existing sessions. A user who controls the linked login method can exploit this race to retain a signed, database-backed, refreshable session as the former primary identity after that method is unlinked; the session persists until expiry or explicit revocation. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Title SuperTokens Core: A session created concurrently with account unlink survives the unlink
Weaknesses CWE-362
CWE-613
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-11-09T18:53:24.985Z

Reserved: 2026-11-06T15:27:56.226Z

Link: CVE-2026-123804

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-09T19:16:47.457

Modified: 2026-11-09T19:16:47.457

Link: CVE-2026-123804

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-09T22:00:15Z

Weaknesses