What is CVE-2026-123804?

CVE-2026-123804 is a medium-severity vulnerability in Supertokens Supertokens-Core, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 6.8/10. Published 2026-11-09.

How severe is CVE-2026-123804?

Medium severity. CVSS v3 base score is 6.8 out of 10.

Vulnerability in Supertokens Supertokens-Core

CVE-2026-123804

SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated and revoked the existing sessions. A user who controls the linked login method can exploit this race to retain a signed, database-backed, refreshable session as the former primary identity after that method is unlinked; the session persists until expiry or explicit revocation. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.

Vulnerability class: Race Condition

Published 2026-11-09.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Supertokens Supertokens-Core — versions >= 11.0.0, < 11.0.9, >= 11.1.0, < 11.1.4, >= 11.2.0, < 11.2.4

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-123804?: CVE-2026-123804 is a medium-severity vulnerability in Supertokens Supertokens-Core, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 6.8/10. Published 2026-11-09.
How severe is CVE-2026-123804?: Medium severity. CVSS v3 base score is 6.8 out of 10.