# CVE-2026-123799: SuperTokens Core dashboard session expiry enforcement

Source: https://junglewise.ai/threats/cve-2026-123799-supertokens-core-is-an-open-source-authentication-server-from-11  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-123799 · Severity: high · CVSS 7.4 · Published 2026-11-09

SuperTokens Core is an open source authentication server that manages user sessions and dashboard access. The dashboard session validation failed to check expiration times, allowing attackers who obtained a stale admin session token to retain full read and write access to the dashboard for weeks beyond the intended 30-day lifetime. An attacker would need to first obtain the session token through another means, as the tokens themselves cannot be guessed.

Technologies: [Supertokens Core](https://junglewise.ai/threats/technologies/supertokens-core). Vendors: [Supertokens](https://junglewise.ai/threats/vendors/supertokens).

## Quick answers

**Is CVE-2026-123799 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123799 being exploited in the wild.

**How severe is CVE-2026-123799?** High severity, with a CVSS score of 7.4, published 9 November 2026.

**Which products and versions are affected?** Supertokens Core 11.0.0 through 11.0.8, 11.1.0 through 11.1.3, 11.2.0 through 11.2.3, 11.3.0 through 11.3.7, 11.4.0 through 11.4.7, 12.0.0 through 12.0.10, 12.1.0 through 12.1.1.

**Is there a fix for CVE-2026-123799?** Yes: fixed in 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123799 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-123799?** Check whether you run Supertokens Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2

## Technical details

Dashboard.isValidUserSession did not compare DashboardSessionInfo.expiry against the current time, instead relying solely on a background cleanup cron that runs every 12 hours and may not execute on frequently restarting instances. An attacker who obtained a valid session identifier could exploit this to maintain unauthorized dashboard access indefinitely via POST /recipe/dashboard/session/verify. The fix enforces expiry checks at verification time rather than depending on eventual cleanup.

## Affected products

- SuperTokens Core 11.0.0 through 11.0.8, 11.1.0 through 11.1.3, 11.2.0 through 11.2.3, 11.3.0 through 11.3.7, 11.4.0 through 11.4.7, 12.0.0 through 12.0.10, 12.1.0 through 12.1.1

## Timeline

- 2026-11-09: disclosed

## References

- [https://github.com/supertokens/supertokens-core/commit/0f4817152278b39fbf21b97c3795b4fc68c12c38](https://github.com/supertokens/supertokens-core/commit/0f4817152278b39fbf21b97c3795b4fc68c12c38)
- [https://github.com/supertokens/supertokens-core/commit/4b315b2382c8eec2cde28fbda113597bffad8da5](https://github.com/supertokens/supertokens-core/commit/4b315b2382c8eec2cde28fbda113597bffad8da5)

## Related threats

- [SuperTokens Core session race condition in account unlink](https://junglewise.ai/threats/cve-2026-123804-supertokens-core-is-an-open-source-authentication-server-from-7)
- [SuperTokens Core cross-tenant WebAuthn authentication bypass](https://junglewise.ai/threats/cve-2026-123803-supertokens-core-is-an-open-source-authentication-server-from-10)
- [SuperTokens Core SAML authentication bypass](https://junglewise.ai/threats/cve-2026-123802-supertokens-core-is-an-open-source-authentication-server-from-11)
- [SuperTokens Core SAML replay protection bypass in callback](https://junglewise.ai/threats/cve-2026-123801-supertokens-core-is-an-open-source-authentication-server-from-11)
- [SuperTokens Core authorization bypass in multitenancy connection URI updates](https://junglewise.ai/threats/cve-2026-123800-supertokens-core-is-an-open-source-authentication-server-from-6)