CVE-2026-37171

The CVSS 5.9 score for CVE-2026-37171 badly misrepresents the severity of this vulnerability. SuperTokens Core — an authentication provider managing sessions and token issuance across tenants — had tenant isolation fail in a way that makes the authentication requirement irrelevant. An authenticated user in Tenant A could enumerate and access Tenant B's sessions. This isn't privilege escalation within a trust domain; it's the collapse of separate trust domains entirely. The vulnerable versions span v6.0.0 through v11.4.0, meaning this gap persisted across multiple major releases. The root cause is almost certainly not 'someone disabled tenant checks' but rather a code path that never required tenant context because it was assumed to be redundant. For authentication providers, this is the classic architectural trap: tenant isolation is the most critical security constraint and the least visible operational requirement, so it gets assumed rather than explicitly enforced. The temporal blast radius extends well past deploying v11.5.0. Sessions issued during the vulnerable window remain active until they expire — if your deployment uses 90-day sessions and ran affected versions for two years, the exposure window stretches 90 days beyond your patch date. This isn't theoretical; it's the actual attack surface. Forensics are nearly impossible. Session enumeration may have happened client-side without server-side logging, leaving no evidence of whether cross-tenant access occurred. Assume exposure rather than audit for absence of access. Upgrade to v11.5.0 immediately, but treat this as a deprecation event, not a routine patch. Audit what workflows, integrations, or compensating controls you built on top of the broken trust model — those implicit dependencies become your new attack surface.

Reviewed through automated stages and approved by a human before publication.