CVE-2026-37171 Overview
CVE-2026-37171 is an authorization vulnerability in SuperTokens Core, an open-source authentication service. Versions v6.0.0 through v11.4.0 fail to enforce tenant separation in a multi-tenant deployment. An authenticated party operating within one tenant can access sessions, data, and endpoints belonging to another tenant. The flaw is classified under CWE-863: Incorrect Authorization.
Critical Impact
Authenticated users in one tenant can read sessions and data belonging to other tenants, breaking the isolation boundary that multi-tenant authentication systems are expected to enforce.
Affected Products
- SuperTokens Core v6.0.0 through v11.4.0
- Self-hosted SuperTokens Core deployments configured for multi-tenancy
- Applications relying on SuperTokens Core tenant isolation for session management
Discovery Timeline
- 2026-08-07 - CVE-2026-37171 published to NVD
- 2026-08-07 - Last updated in NVD database
Technical Details for CVE-2026-37171
Vulnerability Analysis
SuperTokens Core supports multi-tenancy so that a single instance can serve isolated authentication realms for separate applications or customers. CVE-2026-37171 breaks that isolation model. An attacker who authenticates against one tenant can issue requests that resolve against the sessions, data, and endpoints of a different tenant.
The root issue is an authorization check that validates the caller's authentication but does not consistently validate that the target resource belongs to the caller's tenant. This is a classic [CWE-863] pattern where authentication is treated as sufficient proof of access.
Exploitation requires the attacker to already hold valid credentials in at least one tenant on the vulnerable instance. That precondition, combined with the need to craft cross-tenant requests, raises attack complexity but does not require user interaction from the victim tenant.
Root Cause
The vulnerability stems from incorrect authorization logic in the request handling path. Tenant context is not enforced as a mandatory scope on session lookups and endpoint access. As a result, tenant identifiers supplied or inferred during request processing can be manipulated or bypassed to reach records owned by other tenants.
Attack Vector
The attack is executed over the network against the SuperTokens Core API. An authenticated party in Tenant A crafts requests targeting session identifiers or endpoints associated with Tenant B. Because tenant boundaries are not enforced, the service returns data from Tenant B. No verified public proof-of-concept has been published at the time of writing. See the Whiten Baker Security Advisory for technical details.
Detection Methods for CVE-2026-37171
Indicators of Compromise
- Access log entries where a session token or API key associated with one tenant appears in requests targeting resources tagged with a different tenant identifier.
- Unexpected reads of session, user, or metadata endpoints originating from accounts that should be scoped to a single tenant.
- Spikes in 4xx and 2xx responses on tenant-scoped endpoints from a small set of authenticated principals enumerating tenant IDs.
Detection Strategies
- Correlate the authenticated principal's tenant assignment against the tenant identifier of every requested resource in SuperTokens Core logs.
- Build alerts that fire when a single API key or session accesses resources across more than one tenant boundary within a short window.
- Review historical audit logs for the affected version range to identify prior cross-tenant access that predates detection rules.
Monitoring Recommendations
- Forward SuperTokens Core access and audit logs to a centralized analytics platform and retain them long enough to support retrospective hunts.
- Baseline normal per-tenant access patterns for each service account and alert on deviations that cross tenant boundaries.
- Monitor administrative and session-management endpoints with elevated scrutiny, as these are the highest-value targets for cross-tenant abuse.
How to Mitigate CVE-2026-37171
Immediate Actions Required
- Upgrade SuperTokens Core to a version later than v11.4.0 that contains the tenant separation fix.
- Inventory all SuperTokens Core deployments and identify instances running v6.0.0 through v11.4.0.
- Rotate session secrets, API keys, and any credentials that may have been exposed through cross-tenant access during the vulnerable window.
Patch Information
Refer to the Whiten Baker Security Advisory and the official SuperTokens release notes for the fixed version and upgrade guidance. Apply the patched release across all environments, including staging and disaster-recovery replicas.
Workarounds
- Restrict SuperTokens Core API access to trusted application backends only, reducing the population of authenticated callers that could abuse the flaw.
- If multi-tenancy is not required, consolidate onto single-tenant deployments until the patched version can be rolled out.
- Enforce network-layer segmentation between customer environments so that a compromised tenant credential cannot reach another tenant's data path.
# Configuration example
# Verify the running SuperTokens Core version before and after upgrade
curl -s http://<supertokens-host>:3567/hello
curl -s http://<supertokens-host>:3567/apiversion
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
