CVE-2026-123801

HIGH
Published Nov 9, 2026 Modified Nov 12, 2026 CWE-294 CWE-346 CWE-384

Description

SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseTo. In the SP-initiated flow, an attacker who obtains a legitimately issued, still-valid SAML response and its matching RelayState can resubmit the pair to /recipe/saml/callback before the assertion's NotOnOrAfter time; in the IdP-initiated flow, the assertion can be replayed without RelayState. The missing Response.InResponseTo check also permits an in-progress login to be completed with an assertion for a different identity and fails to enforce allowIDPInitiatedLogin=false. The callback does not validate Destination or SubjectConfirmationData Recipient and NotOnOrAfter, and each accepted callback mints a fresh, independently redeemable authorization code carrying the captured user's identity. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.

Is your site exposed to CVE-2026-123801?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.4
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS — Exploit Prediction

0.0035
Probability of exploitation
0.29%
Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-294 CWE-294
CWE-346 CWE-346
CWE-384 CWE-384

References

Other References

https://github.com/supertokens/supertokens-core/commit/075655222f5e72f3683a127e45c83c4174fbd4f7 https://github.com/supertokens/supertokens-core/commit/4e05d8cf60287e9d2720140031a8b8f4430d056f https://github.com/supertokens/supertokens-core/commit/557835406547d269f5d0e33159630a1873461c38 https://github.com/supertokens/supertokens-core/commit/5c42f02e98f67174c6a5a800dd9f8bd5b6e98486 https://github.com/supertokens/supertokens-core/commit/b6730e608b2d4562939cd4f41ea07df5f841dfe5 https://github.com/supertokens/supertokens-core/commit/ca2bca9bc900c2fd399d508818ad026cc977dcf6 https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8 https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8 https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11 https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2

Frequently Asked Questions

What is CVE-2026-123801? +
SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseTo. In the SP-initiated flow, an attacker who obtains a legitimately issued, still-valid SAML response and its matching RelayState can resubmit the pair to /recipe/saml/callback before the assertion's NotOnOrAfter time; in the IdP-initiated flow, the assertion can be replayed without RelayState. The missing Response.InResponseTo check also permits an in-progress login to be completed with an assertion for a different identity and fails to enforce allowIDPInitiatedLogin=false. The callback does not validate Destination or SubjectConfirmationData Recipient and NotOnOrAfter, and each accepted callback mints a fresh, independently redeemable authorization code carrying the captured user's identity. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1. It has a CVSS v3.1 base score of 7.4 (HIGH).
How severe is CVE-2026-123801? +
CVE-2026-123801 has a CVSS v3.1 score of 7.4 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0035, placing it in the 0th percentile for exploitation probability.
How do I check if I'm vulnerable to CVE-2026-123801? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-55250

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from …
CVE-2026-34021

The Wertheim SafeController 5400, Controller 5400 - AssemblyVersion 6.11.8130.22320, uses RS-485 communication between the server and the microcontroller without cryptographic …
CVE-2026-103655

MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted …
CVE-2026-12655

A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid …
CVE-2026-67581

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled …
CVE-2026-104381

A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2026-123801 — free, no signup required.

Patch and protect

Block known exploits with a web application firewall while you patch, keep your own devices clean, or test the fix on a fresh server.

Compare VPS prices →
Sucuri Sucuri → Website firewall, malware cleanup & monitoring NordPass NordPass → Password manager with breach alerts Malwarebytes Malwarebytes → Anti-malware for Windows, Mac and phones, 25% off Contabo Contabo → Cheap VPS & dedicated servers, EU/US/Asia
Vultr Vultr → Cloud VPS in 30+ locations, hourly billing NordVPN NordVPN → Hide your IP, servers in 120+ countries Surfshark Surfshark → Unlimited devices, from ~$2/mo

Affiliate links: we may earn a commission, your price stays the same.