Whitenbaker
Vendor Guide
How CVE assignment works.
A short, factual guide for vendors receiving a disclosure from Whitenbaker. If your product has never had a CVE, the process below is probably unfamiliar.
What a CVE is
A CVE is an identifier, not a judgement.
It gives one vulnerability one permanent public name so that operators, scanners, package managers and procurement teams can all refer to the same thing. The record says what the defect is, which versions are affected, and where to read more. It does not grade your company and it is not a penalty.
Who assigns it
CVE IDs are issued by CVE Numbering Authorities.
Large vendors are usually their own CNA and assign IDs for their own products. Where a product is not covered by any CNA, assignment falls to the CNA of Last Resort, which the CVE Program defines as the authority that assigns IDs and publishes records “for vulnerabilities not covered by the scope of another CNA.”
In practice that means MITRE. If your organisation is not a CNA, requests concerning your product go to MITRE directly, through the CVE Request web form. This is the ordinary route, not an escalation.
Who can request one
Anyone.
Researchers, users, and vendors all submit requests, and third-party requests are a normal and expected part of the programme. Vendor consent is not part of the mechanism, and the effect of that is straightforward: the identifier exists so downstream operators can learn that a defect affects software they are running, and that purpose would be defeated if it depended on the affected vendor agreeing to it.
The actual sequence
Four steps. One gate.Request
A form submission describing the vulnerability, the affected product and the affected versions. The submitter receives an acknowledgement carrying a request number, in the form CVE Request NNNNNNN. That number tracks the request; it is not yet a CVE ID.
Review
A CVE Assignment Team member reviews it. They frequently come back asking for missing detail, most often a version identifier. A request without one can sit unassigned indefinitely.
Assignment
An ID is reserved. At this point the ID exists but the record is not public and contains nothing readable.
Publication
The record only goes public once it has a public reference to point at. In practice that reference is the researcher’s advisory page.
CVE-2026-37171
- Researcher
- Whitenbaker Security Research
- Assigner
- MITRE CNA of Last Resort
- Product
- SuperTokens Core v6.0.0 to v11.4.0
- Reference
- whitenbaker.com/supertokens-core-multitenant-advisory
The public record hinges on the researcher’s final confirmation. If they change their mind, for any reason, the CVE stays in purgatory. Once it posts, it remains. It cannot be rescinded.
The part vendors usually do not expect
The decision belongs to the researcher, and that is the single most important property of the system.
Why it matters
Publication is gated on that reference.
Until an advisory exists at a public URL and that URL is supplied to MITRE, an assigned CVE stays reserved and unreadable. It does not publish on a timer and it does not publish because a deadline passed. No vendor or researcher can compel publication, but one can prevent it unilaterally. That one is the researcher.
The advisory has to be written, hosted and paid for by the person who found the defect. So the one irreducible step in the entire process sits with the finder.
This matters because of what the rest of the field looks like. A researcher who reports privately has, at that moment, given away everything they hold and received nothing. The vendor can fix it and say nothing. They can try and dispute the severity. They can go quiet for months and simply never reply. All of those happen constantly and the researcher has no recourse, because the information is already across the table and cannot be taken back.
The reference requirement is the counterweight. It means the finder retains one thing that cannot be taken, ignored, or waited out: the decision about whether the world learns this existed or not, and when. Whatever else a vendor does or fails to do, that remains with the person who did the work. The CVE Program deserves considerable credit for a design that has that effect, because very little else in vulnerability disclosure does.
It is also precisely what makes genuine coordination possible rather than merely requested. A researcher who holds the timing can afford to align publication with a vendor’s release schedule, because doing so costs them nothing they cannot get back. A researcher who holds nothing can only ask, and hope.
What any individual researcher then does with that decision is theirs. Some publish everything on principle or resentment. Some agree terms with a vendor and publish nothing. Some are funding a mortgage or a medical bill and weigh it accordingly, and that is a legitimate position held by people doing legitimate work. The point of the design is not that everyone reaches the same answer. It is that the answer belongs to the person who did the work rather than to whoever is on the other side of the table, and that is true whichever way they decide.
One consequence worth stating plainly: elapsed time between assignment and publication is normal and often long. Weeks is ordinary. A reserved CVE that has not published is not a threat hanging over anyone. It is a record waiting on an advisory and final confirmation from the one person who submitted it.
What this means for you
Four things worth knowing.You can coordinate timing
If a fix is in progress, say so and say when. Aligning publication with a release is standard practice and costs the researcher nothing.
You cannot require silence, but you can ask for it
Assignment does not need your agreement and publication cannot be compelled from your side either way. Whether a given researcher publishes, delays, or agrees terms with you is their decision to make, and different researchers answer it differently for reasons that are their own. What is worth knowing is which of those you are dealing with, and asking directly is a reasonable thing to do.
You can become a CNA
Organisations that expect recurring disclosures often apply to become their own CNA, which lets them assign and publish for their own products and control the wording of their own records. Before authorisation, organisations commonly assign through MITRE’s CNA of Last Resort in the meantime.
A CVE is not an accusation
Every substantial software product accumulates them. An absence of CVEs is not evidence of an absence of defects; it usually means nobody has filed. What procurement teams actually look at is whether a vendor handles disclosure well, and a published record with a clear advisory and a fixed version reads considerably better than silence.
How Whitenbaker handles it
Findings go to the vendor first, in full, with file, function and affected versions.
CVE requests are lodged so the identifier exists. Advisories are written and published, and the URL supplied to MITRE, on a timeline coordinated with the vendor’s remediation wherever the vendor engages on one. Where a vendor does not engage, or engages in bad faith, the advisory can publish immediately and usually does.
For vendors: if a fix is in progress, say so and say when.
Aligning publication with a release is standard practice and costs the researcher nothing.
Sources: CVE Program documentation on CNAs and the CNA of Last Resort (cve.org/ProgramOrganization/CNAs, CNA Operational Rules). Process detail reflects Whitenbaker’s own submissions to the MITRE CNA-LR.