144 lines
6.7 KiB
JSON
144 lines
6.7 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-123798",
|
|
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "GitHub_M",
|
|
"dateReserved": "2026-11-06T15:27:56.225Z",
|
|
"datePublished": "2026-11-09T18:04:20.419Z",
|
|
"dateUpdated": "2026-11-09T18:04:20.419Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"title": "SuperTokens Core: SAML XML Signature Wrapping authentication bypass — any IdP user can authenticate as any other user",
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"cweId": "CWE-287",
|
|
"lang": "en",
|
|
"description": "CWE-287: Improper Authentication",
|
|
"type": "CWE"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"cweId": "CWE-347",
|
|
"lang": "en",
|
|
"description": "CWE-347: Improper Verification of Cryptographic Signature",
|
|
"type": "CWE"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"attackComplexity": "LOW",
|
|
"attackVector": "NETWORK",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 8.1,
|
|
"baseSeverity": "HIGH",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "HIGH",
|
|
"privilegesRequired": "LOW",
|
|
"scope": "UNCHANGED",
|
|
"userInteraction": "NONE",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
|
|
"version": "3.1"
|
|
}
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"name": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-gvx2-mwmj-wwvj",
|
|
"tags": [
|
|
"x_refsource_CONFIRM"
|
|
],
|
|
"url": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-gvx2-mwmj-wwvj"
|
|
},
|
|
{
|
|
"name": "https://github.com/supertokens/supertokens-core/commit/8d06b0cfb5409c5bf505051ddfcb94d66367caae",
|
|
"tags": [
|
|
"x_refsource_MISC"
|
|
],
|
|
"url": "https://github.com/supertokens/supertokens-core/commit/8d06b0cfb5409c5bf505051ddfcb94d66367caae"
|
|
},
|
|
{
|
|
"name": "https://github.com/supertokens/supertokens-core/commit/9cba541ae2ed87b878d11b257bc9b8b78341f50a",
|
|
"tags": [
|
|
"x_refsource_MISC"
|
|
],
|
|
"url": "https://github.com/supertokens/supertokens-core/commit/9cba541ae2ed87b878d11b257bc9b8b78341f50a"
|
|
},
|
|
{
|
|
"name": "https://github.com/supertokens/supertokens-core/commit/d0773f2a6497411aeda5d4f03d3d135a2a3ae79c",
|
|
"tags": [
|
|
"x_refsource_MISC"
|
|
],
|
|
"url": "https://github.com/supertokens/supertokens-core/commit/d0773f2a6497411aeda5d4f03d3d135a2a3ae79c"
|
|
},
|
|
{
|
|
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.7",
|
|
"tags": [
|
|
"x_refsource_MISC"
|
|
],
|
|
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.7"
|
|
},
|
|
{
|
|
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.7",
|
|
"tags": [
|
|
"x_refsource_MISC"
|
|
],
|
|
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.7"
|
|
},
|
|
{
|
|
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.10",
|
|
"tags": [
|
|
"x_refsource_MISC"
|
|
],
|
|
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.10"
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"vendor": "supertokens",
|
|
"product": "supertokens-core",
|
|
"versions": [
|
|
{
|
|
"version": ">= 12.0.6, < 12.0.10",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": ">= 11.4.0, < 11.4.7",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": ">= 11.3.0, < 11.3.7",
|
|
"status": "affected"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"providerMetadata": {
|
|
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
|
"shortName": "GitHub_M",
|
|
"dateUpdated": "2026-11-09T18:04:20.419Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.7, 11.4.7, and 12.0.10, SAML.verifySamlResponseSignature calls OpenSAML SignatureValidator.validate without first applying SAMLSignatureProfileValidator. The Core can therefore accept a cryptographically valid signature that references a different XML element from the Response or Assertion whose NameID and attributes are used for authentication. An ordinary user of the configured identity provider can move a genuinely signed element elsewhere in the document while supplying an attacker-authored identity-bearing element, causing XML Signature Wrapping authentication as another IdP user. Both response-level and assertion-level signing paths are affected, and SP-initiated login remains reachable without enabling allowIDPInitiatedLogin. This issue is fixed in versions 11.3.7, 11.4.7, and 12.0.10."
|
|
}
|
|
],
|
|
"source": {
|
|
"advisory": "GHSA-gvx2-mwmj-wwvj",
|
|
"discovery": "UNKNOWN"
|
|
}
|
|
}
|
|
}
|
|
} |