Search
Find a vulnerability
Search criteria
4 vulnerabilities found for sso by better-auth
CVE-2026-80192 (GCVE-0-2026-80192)
Vulnerability from nvd – Published: 2026-08-25 23:19 – Updated: 2026-08-29 11:48
VLAI
EPSS
VEX
Title
better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass
Summary
@better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line) contains two domain-ownership flaws. When domain verification is disabled, automatic organization assignment accepts unverified provider domains, allowing an authenticated organization owner/administrator to register an SSO provider for an arbitrary domain and have users with matching email domains added to the attacker's organization with default member permissions. When domain verification is enabled, a race condition between the verify-domain and update-provider endpoints can apply completed DNS proof to a different domain; combined with implicit account linking, this can link an attacker-controlled identity provider to an existing user account. Exploitation requires the SSO plugin (and, for the org-assignment path, the organization plugin) with the relevant configuration enabled.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 13:43 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/better-auth/better-auth/securi… | vendor-advisory |
| https://www.vulncheck.com/advisories/better-auth-… | third-party-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| better-auth | sso |
Affected:
1.4.8-beta.1 , < 1.4.8
(semver)
Unaffected: 1.4.8 (semver) |
|
| better-auth | sso |
Affected:
1.4.9 , < 1.6.27
(semver)
Unaffected: 1.6.27 (semver) |
|
| better-auth | sso |
Affected:
1.7.0-beta.0 , < 1.7.0-rc.5
(semver)
Unaffected: 1.7.0-rc.5 (semver) |
Date Public
2026-08-11 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80192",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T13:43:37.837773Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T13:43:48.141Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/better-auth/sso",
"product": "sso",
"vendor": "better-auth",
"versions": [
{
"lessThan": "1.4.8",
"status": "affected",
"version": "1.4.8-beta.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.4.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/better-auth/sso",
"product": "sso",
"vendor": "better-auth",
"versions": [
{
"lessThan": "1.6.27",
"status": "affected",
"version": "1.4.9",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.6.27",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/better-auth/sso",
"product": "sso",
"vendor": "better-auth",
"versions": [
{
"lessThan": "1.7.0-rc.5",
"status": "affected",
"version": "1.7.0-beta.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.7.0-rc.5",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:better-auth:better-auth\\/sso:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.4.8",
"versionStartIncluding": "1.4.8-beta.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:better-auth:better-auth\\/sso:-:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:better-auth:better-auth\\/sso:-:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "jaydns"
},
{
"lang": "en",
"type": "reporter",
"value": "ahacker1-securesaml"
},
{
"lang": "en",
"type": "reporter",
"value": "iaohkut-from-NightWolf-Team"
}
],
"datePublic": "2026-08-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "@better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line) contains two domain-ownership flaws. When domain verification is disabled, automatic organization assignment accepts unverified provider domains, allowing an authenticated organization owner/administrator to register an SSO provider for an arbitrary domain and have users with matching email domains added to the attacker\u0027s organization with default member permissions. When domain verification is enabled, a race condition between the verify-domain and update-provider endpoints can apply completed DNS proof to a different domain; combined with implicit account linking, this can link an attacker-controlled identity provider to an existing user account. Exploitation requires the SSO plugin (and, for the org-assignment path, the organization plugin) with the relevant configuration enabled."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T11:48:04.728Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-8c5h-wx78-2cfg)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-8c5h-wx78-2cfg"
},
{
"name": "VulnCheck Advisory: better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/better-auth-sso-before-1.6.27-domain-ownership-authentication-bypass"
}
],
"title": "better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80192",
"datePublished": "2026-08-25T23:19:00.371Z",
"dateReserved": "2026-08-25T23:14:37.730Z",
"dateUpdated": "2026-08-29T11:48:04.728Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-67328 (GCVE-0-2026-67328)
Vulnerability from nvd – Published: 2026-08-01 12:22 – Updated: 2026-08-14 16:50
VLAI
EPSS
VEX
Title
@better-auth/sso before 1.6.21 Account Takeover via SSO
Summary
@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints to gain unauthorized session access and account takeover.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 19:39 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/better-auth/better-auth/securi… | vendor-advisory |
| https://www.vulncheck.com/advisories/better-auth-… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| better-auth | sso |
Affected:
0 , < 1.6.21
(semver)
Unaffected: 1.6.21 (semver) |
|
| better-auth | sso |
Affected:
1.7.0-beta.0 , < 1.7.0-beta.10
(semver)
Unaffected: 1.7.0-beta.10 (semver) |
Date Public
2026-06-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67328",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T19:39:11.641219Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T19:39:20.435Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/better-auth/sso",
"product": "sso",
"vendor": "better-auth",
"versions": [
{
"lessThan": "1.6.21",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.6.21",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/better-auth/sso",
"product": "sso",
"vendor": "better-auth",
"versions": [
{
"lessThan": "1.7.0-beta.10",
"status": "affected",
"version": "1.7.0-beta.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.7.0-beta.10",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:better-auth:better-auth\\/sso:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "1.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:better-auth:better-auth\\/sso:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "1.7.0-beta.10",
"versionStartIncluding": "1.7.0-beta.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-06-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints to gain unauthorized session access and account takeover."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:50:54.741Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-prpr-5gj3-qqhg)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-prpr-5gj3-qqhg"
},
{
"name": "VulnCheck Advisory: @better-auth/sso before 1.6.21 Account Takeover via SSO",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/better-auth-sso-before-account-takeover-via-sso"
}
],
"title": "@better-auth/sso before 1.6.21 Account Takeover via SSO",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-67328",
"datePublished": "2026-08-01T12:22:17.940Z",
"dateReserved": "2026-07-29T13:07:47.015Z",
"dateUpdated": "2026-08-14T16:50:54.741Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80192 (GCVE-0-2026-80192)
Vulnerability from cvelistv5 – Published: 2026-08-25 23:19 – Updated: 2026-08-29 11:48
VLAI
EPSS
VEX
Title
better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass
Summary
@better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line) contains two domain-ownership flaws. When domain verification is disabled, automatic organization assignment accepts unverified provider domains, allowing an authenticated organization owner/administrator to register an SSO provider for an arbitrary domain and have users with matching email domains added to the attacker's organization with default member permissions. When domain verification is enabled, a race condition between the verify-domain and update-provider endpoints can apply completed DNS proof to a different domain; combined with implicit account linking, this can link an attacker-controlled identity provider to an existing user account. Exploitation requires the SSO plugin (and, for the org-assignment path, the organization plugin) with the relevant configuration enabled.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 13:43 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/better-auth/better-auth/securi… | vendor-advisory |
| https://www.vulncheck.com/advisories/better-auth-… | third-party-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| better-auth | sso |
Affected:
1.4.8-beta.1 , < 1.4.8
(semver)
Unaffected: 1.4.8 (semver) |
|
| better-auth | sso |
Affected:
1.4.9 , < 1.6.27
(semver)
Unaffected: 1.6.27 (semver) |
|
| better-auth | sso |
Affected:
1.7.0-beta.0 , < 1.7.0-rc.5
(semver)
Unaffected: 1.7.0-rc.5 (semver) |
Date Public
2026-08-11 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80192",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T13:43:37.837773Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T13:43:48.141Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/better-auth/sso",
"product": "sso",
"vendor": "better-auth",
"versions": [
{
"lessThan": "1.4.8",
"status": "affected",
"version": "1.4.8-beta.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.4.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/better-auth/sso",
"product": "sso",
"vendor": "better-auth",
"versions": [
{
"lessThan": "1.6.27",
"status": "affected",
"version": "1.4.9",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.6.27",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/better-auth/sso",
"product": "sso",
"vendor": "better-auth",
"versions": [
{
"lessThan": "1.7.0-rc.5",
"status": "affected",
"version": "1.7.0-beta.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.7.0-rc.5",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:better-auth:better-auth\\/sso:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.4.8",
"versionStartIncluding": "1.4.8-beta.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:better-auth:better-auth\\/sso:-:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:better-auth:better-auth\\/sso:-:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "jaydns"
},
{
"lang": "en",
"type": "reporter",
"value": "ahacker1-securesaml"
},
{
"lang": "en",
"type": "reporter",
"value": "iaohkut-from-NightWolf-Team"
}
],
"datePublic": "2026-08-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "@better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line) contains two domain-ownership flaws. When domain verification is disabled, automatic organization assignment accepts unverified provider domains, allowing an authenticated organization owner/administrator to register an SSO provider for an arbitrary domain and have users with matching email domains added to the attacker\u0027s organization with default member permissions. When domain verification is enabled, a race condition between the verify-domain and update-provider endpoints can apply completed DNS proof to a different domain; combined with implicit account linking, this can link an attacker-controlled identity provider to an existing user account. Exploitation requires the SSO plugin (and, for the org-assignment path, the organization plugin) with the relevant configuration enabled."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T11:48:04.728Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-8c5h-wx78-2cfg)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-8c5h-wx78-2cfg"
},
{
"name": "VulnCheck Advisory: better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/better-auth-sso-before-1.6.27-domain-ownership-authentication-bypass"
}
],
"title": "better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80192",
"datePublished": "2026-08-25T23:19:00.371Z",
"dateReserved": "2026-08-25T23:14:37.730Z",
"dateUpdated": "2026-08-29T11:48:04.728Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-67328 (GCVE-0-2026-67328)
Vulnerability from cvelistv5 – Published: 2026-08-01 12:22 – Updated: 2026-08-14 16:50
VLAI
EPSS
VEX
Title
@better-auth/sso before 1.6.21 Account Takeover via SSO
Summary
@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints to gain unauthorized session access and account takeover.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 19:39 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/better-auth/better-auth/securi… | vendor-advisory |
| https://www.vulncheck.com/advisories/better-auth-… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| better-auth | sso |
Affected:
0 , < 1.6.21
(semver)
Unaffected: 1.6.21 (semver) |
|
| better-auth | sso |
Affected:
1.7.0-beta.0 , < 1.7.0-beta.10
(semver)
Unaffected: 1.7.0-beta.10 (semver) |
Date Public
2026-06-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67328",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T19:39:11.641219Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T19:39:20.435Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/better-auth/sso",
"product": "sso",
"vendor": "better-auth",
"versions": [
{
"lessThan": "1.6.21",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.6.21",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/better-auth/sso",
"product": "sso",
"vendor": "better-auth",
"versions": [
{
"lessThan": "1.7.0-beta.10",
"status": "affected",
"version": "1.7.0-beta.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.7.0-beta.10",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:better-auth:better-auth\\/sso:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "1.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:better-auth:better-auth\\/sso:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "1.7.0-beta.10",
"versionStartIncluding": "1.7.0-beta.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-06-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints to gain unauthorized session access and account takeover."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:50:54.741Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-prpr-5gj3-qqhg)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-prpr-5gj3-qqhg"
},
{
"name": "VulnCheck Advisory: @better-auth/sso before 1.6.21 Account Takeover via SSO",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/better-auth-sso-before-account-takeover-via-sso"
}
],
"title": "@better-auth/sso before 1.6.21 Account Takeover via SSO",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-67328",
"datePublished": "2026-08-01T12:22:17.940Z",
"dateReserved": "2026-07-29T13:07:47.015Z",
"dateUpdated": "2026-08-14T16:50:54.741Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}