← CVE Radar
CVE-2026-37171
A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of another tenant.
9.6 CRITICALEPSS 0.25%Not in KEVNVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.6 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N |
| 5.9 | MEDIUM | 3.1mitre (CNA) | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N |
| 5.9 | MEDIUM | 3.1mitre (CNA) | CVSS:3.1/AC:H/AV:N/A:N/C:H/I:L/PR:L/S:U/UI:N |
Details
- CVE ID
- CVE-2026-37171
- Status
- Analyzed
- Assigner (CNA)
- mitre
- Published
- Aug 7, 2026
- Last modified
- 2026-10-30 16:33 UTC
- Weaknesses
Affected Products
From NVD CPE configurations.
supertokenssupertokens1 version range
- 6.0.0 through 11.4.0