CVE-2026-37171: SuperTokens Core cross-tenant session isolation bypass (6.0.0-11.4.0)

As cited

Copy frozen at 2026-09-10 00:44 UTC (site build).

vulnerabilities

CVE-2026-37171: SuperTokens Core cross-tenant session isolation bypass (6.0.0-11.4.0)

CVE-2026-37171 is a cross-tenant authorization flaw in SuperTokens Core versions 6.0.0 through 11.4.0 that allows improper session isolation between tenants. The vulnerability stems from insufficient tenant separation in session operations, classified under CWE-863 (Incorrect Authorization). Organizations running affected versions face exposure to unauthorized cross-tenant access.

Why it matters: Teams deploying SuperTokens Core for multi-tenant authentication must upgrade immediately, as an attacker can potentially access sessions and data across tenant boundaries.

Source published

2026-09-09 14:35 UTC

First seen by Cybersecurity Tracker

2026-09-10 00:17 UTC