MEDIUM Published August 7, 2026

CVE-2026-37171

A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of another tenant.

CVSS base score

5.9 (v3.1)

Severity

MEDIUM

Attack vector

Network

Weakness

CWE-863

Last modified

October 30, 2026

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Affected products

supertokens supertokens

References

whitenbaker.com Exploit, Third Party Advisory
www.openwall.com Mailing List, Third Party Advisory
whitenbaker.com Exploit, Third Party Advisory

View full NVD advisory →

Published the same day

← Back to CVE watch

CVE-2026-37171

Affected products

References

Published the same day

Related reading