SuperTokens Core, the open-source authentication server used by applications to manage logins and sessions, carries a critical flaw that can let a limited API key take over other applications sharing the same server. The vulnerability, tracked as CVE-2026-123800, scores 9.9 out of 10 and was published on Monday 9 November 2026.

The flaw concerns app-scoped API keys. SuperTokens Core lets each application use its own API key, which should only grant access to that application's data. According to the CVE record, an app-scoped key can instead overwrite the credentials of the parent connection URI domain, the address the server uses to reach its own database. Once those credentials are replaced, the holder of the limited key can take over sibling applications running on the same Core instance.

Who is affected

The flaw affects SuperTokens Core from version 6.0.0 onwards, spanning the 6.0, 7.0, 8.0, 9.x and 10.0 release lines. A fix is available, and operators should upgrade to the latest patched release for the line they run. The vulnerability was published alongside four related SuperTokens Core flaws on the same day, covering WebAuthn sign-in, SAML assertions and dashboard session tokens, which underlines the scale of the security update.

API keys are central to how SuperTokens works. Backend services send an API key with every request to a self-hosted Core, and the server answers with an error if the key does not match. The whole point of scoping a key to one application is containment: a key issued for one app should be useless everywhere else. This flaw breaks that boundary, turning a single application's credential into a route to the shared server and everything on it.

What to do now

Administrators running SuperTokens Core should upgrade immediately and then rotate their API keys, since a key that was already misused cannot be trusted. They should also review which applications share a Core instance and check for unexpected changes to connection settings or application data. Any organisation that cannot upgrade at once should limit network access to the Core server so that only trusted backend services can reach it.

Neither of the sources reporting the flaw describes active exploitation, and the vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalogue. That is no reason to delay: a 9.9 score reflects how little effort the attack requires and how complete the takeover can be. Self-hosted authentication servers are attractive targets precisely because one compromise can open many applications at once, so patching this flaw should come before any other maintenance on affected systems.