CVE-2026-37171 describes a lack of tenant separation in SuperTokens Core from versions 6.0.0 to 11.4.0. This flaw enables an authenticated party within one tenant to access sessions, data, and endpoints of other tenants, violating tenant isolation principles. The vulnerability is classified under CWE-863 (Incorrect Authorization). The CVSS 3.1 base score is 5.9, indicating a medium severity with network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.

An attacker authenticated in one tenant can access sensitive session information and data belonging to other tenants, potentially leading to unauthorized data disclosure. The integrity impact is low and availability is not affected. This compromises tenant isolation and confidentiality within the affected versions of SuperTokens Core.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor communications for updates and apply any official patches once available. Until then, consider restricting authenticated user privileges and tenant access controls as a temporary mitigation.