CVE-2026-37171

MediumCVSS 5.9

Published: 07/08/2026(UTC)Updated: 07/08/2026(UTC)Translated: 07/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

A lack of tenant separation in SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of another tenant.

Risk Assessment

Breach of tenant isolation can lead to data leakage and unauthorized access to other customers' resources.

Recommendation

Update SuperTokens Core to a patched version as soon as possible. Until then, monitor activity and restrict access to the system.

Original NVD description (English source)

A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of another tenant.