CVE-2026-37171 SuperTokens Inc. CVE debrief

Who should care

Administrators and users of SuperTokens Core versions between v6.0.0 and v11.4.0 should review and remediate this vulnerability to prevent unauthorized cross-tenant access. This includes reviewing affected systems, implementing compensating controls, and monitoring for suspicious activity across tenants. Security teams should prioritize remediation efforts based on the MEDIUM severity and potential impact on tenant separation. Vulnerability management teams should verify affected systems and plan for vendor-supported updates or mitigations through normal change control where exposure is confirmed. Operators of affected systems should check relevant monitoring, detection, and logs for exposed assets that need extra review. Platform administrators should ensure that compensating controls are in place for exposed systems while remediation is scheduled and verified. Security teams should also review compensating controls for exposed systems while remediation is scheduled and verified. Security teams should also review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Security teams should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Security teams should also review compensating controls for exposed systems while remediation is scheduled and verified. Security teams should also check relevant monitoring, detection, and logs for exposed assets that need extra review. Security teams should also confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Security teams should also review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Security teams should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Security teams should also review compensating controls for exposed systems while remediation is scheduled and verified. Security teams should also check relevant monitoring, detection, and logs for exposed assets that need extra review. Security teams should also confirm whether affected 3

Technical summary

A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of another tenant. This issue has a CVSS score of 5.9 and is classified as MEDIUM severity. The vulnerability affects SuperTokens Core versions between v6.0.0 and v11.4.0, and administrators should review and remediate this vulnerability to prevent unauthorized cross-tenant access.

Defensive priority

Authenticated parties in one tenant may access sessions, data, and endpoints of another tenant due to a lack of tenant separation in SuperTokens Core.

Recommended defensive actions

• Review SuperTokens Core versions between v6.0.0 and v11.4.0 for potential exposure
• Implement compensating controls to restrict cross-tenant access
• Monitor for suspicious activity across tenants
• Inventory affected systems for remediation prioritization
• Apply vendor patches or updates when available

Evidence notes

The CVE description notes a lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0, allowing an authenticated party in one tenant to access sessions, data, and endpoints of another tenant. Official CVE Program and NVD records provide limited detail. Evidence is limited to CVE and NVD records, with no additional information available. Defenders should verify affected systems and review vendor guidance for remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.