supertokens-core v12.2.1

• Serializes session creation with account unlink to close a session race (GHSA-2pc4-vw9j-454c).
• Enforces SAML callback replay protection and request binding (GHSA-3r7x-rhvc-fw28).
• SAML: a client can carry an optional ACS-URL allow-list (acsURLs). When set, the login’s ACS URL (SP-initiated) and the response Destination/SubjectConfirmationData.Recipient (IdP-initiated) must be a member — extending Destination/Recipient pinning to the IdP-initiated path, which previously had no anchor. The list is required when IdP-initiated login is enabled: it is checked on every client create/update, and IdP-initiated logins for an existing client without one are refused until it is set. (GHSA-3r7x-rhvc-fw28 follow-up)
• Binds SAML identity to a single validated assertion, which must carry a signed Recipient matching the ACS URL; saml_sp_entity_id keeps its default (GHSA-wfg2-vqfg-rqh6).
• Scopes WebAuthn sign-in to the requested tenant (GHSA-6v34-w48w-44rc).
• Prevents an app-scoped API key from updating its parent connectionUriDomain (GHSA-4rf2).

Migration

The SAML replay hardening adds two columns to saml_relay_state, the saml_consumed_assertions table, and the IdP-initiated ACS allow-list column on saml_clients. Applied automatically at startup (CREATE TABLE / ADD COLUMN IF NOT EXISTS); large PostgreSQL deployments can pre-apply the postgresql-plugin’s migration-scripts/v9.8.1.sql ahead of the upgrade. Additive and online-safe.

ALTER TABLE saml_relay_state ADD COLUMN IF NOT EXISTS in_response_to VARCHAR(256);
ALTER TABLE saml_relay_state ADD COLUMN IF NOT EXISTS acs_url TEXT;

CREATE TABLE IF NOT EXISTS saml_consumed_assertions (
    app_id VARCHAR(64) NOT NULL DEFAULT 'public',
    tenant_id VARCHAR(64) NOT NULL DEFAULT 'public',
    assertion_id VARCHAR(256) NOT NULL,
    expires_at BIGINT NOT NULL,
    CONSTRAINT saml_consumed_assertions_pkey PRIMARY KEY(app_id, tenant_id, assertion_id),
    CONSTRAINT saml_consumed_assertions_app_id_fkey FOREIGN KEY(app_id) REFERENCES apps (app_id) ON DELETE CASCADE,
    CONSTRAINT saml_consumed_assertions_tenant_id_fkey FOREIGN KEY(app_id, tenant_id) REFERENCES tenants (app_id, tenant_id) ON DELETE CASCADE
);

CREATE INDEX IF NOT EXISTS saml_consumed_assertions_expires_at_index ON saml_consumed_assertions (expires_at);

ALTER TABLE saml_clients ADD COLUMN IF NOT EXISTS acs_urls TEXT;

Full Changelog: https://github.com/supertokens/supertokens-core/compare/v12.2.0…v12.2.1

---

Source supertokens/supertokens-core · v12.2.1 · 2026-10-16 · upstream release

Mirrored verbatim for indexing. All rights belong to the upstream project.