Is CVE-2026-123799 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123799 being exploited in the wild.

How severe is CVE-2026-123799?

High severity, with a CVSS score of 7.4, published 9 November 2026.

Which products and versions are affected?

Supertokens Core 11.0.0 through 11.0.8, 11.1.0 through 11.1.3, 11.2.0 through 11.2.3, 11.3.0 through 11.3.7, 11.4.0 through 11.4.7, 12.0.0 through 12.0.10, 12.1.0 through 12.1.1.

Is there a fix for CVE-2026-123799?

Yes: fixed in 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-123799 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-123799?

Check whether you run Supertokens Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123799: SuperTokens Core dashboard session expiry enforcement

CVE-2026-123799 · Severity: high · CVSS 7.4 · Published 2026-11-09

SuperTokens Core is an open source authentication server that manages user sessions and dashboard access. The dashboard session validation failed to check expiration times, allowing attackers who obtained a stale admin session token to retain full read and write access to the dashboard for weeks beyond the intended 30-day lifetime. An attacker would need to first obtain the session token through another means, as the tokens themselves cannot be guessed.

Technologies: Supertokens Core. Vendors: Supertokens.

Quick answers

Is CVE-2026-123799 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123799 being exploited in the wild.
How severe is CVE-2026-123799?: High severity, with a CVSS score of 7.4, published 9 November 2026.
Which products and versions are affected?: Supertokens Core 11.0.0 through 11.0.8, 11.1.0 through 11.1.3, 11.2.0 through 11.2.3, 11.3.0 through 11.3.7, 11.4.0 through 11.4.7, 12.0.0 through 12.0.10, 12.1.0 through 12.1.1.
Is there a fix for CVE-2026-123799?: Yes: fixed in 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123799 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-123799?: Check whether you run Supertokens Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2

Technical details

Dashboard.isValidUserSession did not compare DashboardSessionInfo.expiry against the current time, instead relying solely on a background cleanup cron that runs every 12 hours and may not execute on frequently restarting instances. An attacker who obtained a valid session identifier could exploit this to maintain unauthorized dashboard access indefinitely via POST /recipe/dashboard/session/verify. The fix enforces expiry checks at verification time rather than depending on eventual cleanup.

Affected products

SuperTokens Core 11.0.0 through 11.0.8, 11.1.0 through 11.1.3, 11.2.0 through 11.2.3, 11.3.0 through 11.3.7, 11.4.0 through 11.4.7, 12.0.0 through 12.0.10, 12.1.0 through 12.1.1

Timeline

2026-11-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.