CVE-2026-67328
8.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Summary
@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints to gain unauthorized session access and account takeover.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| better-auth | sso | 0 < 1.6.21 | affected |
| better-auth | sso | 1.6.21 | unaffected |
| better-auth | sso | 1.7.0-beta.0 < 1.7.0-beta.10 | affected |
| better-auth | sso | 1.7.0-beta.10 | unaffected |
Weaknesses
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- https://github.com/better-auth/better-auth/security/advisories/GHSA-prpr-5gj3-qqhg
- https://www.vulncheck.com/advisories/better-auth-sso-before-account-takeover-via-sso
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.