# CVE-2026-110863: Better Auth SSO authentication bypass via personal provider identity spoofing

Source: https://junglewise.ai/threats/cve-2026-110863-better-auth-better-auth-sso-from-1-7-0-rc-2-before-1-7-3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-110863 · Severity: high · CVSS 8.1 · Published 2026-10-14

Better Auth SSO is an authentication component used to let applications offer single sign-on through providers like Google or Okta. A vulnerability allows authenticated attackers to hijack other users' accounts by creating a fake SSO provider that mimics a legitimate one, allowing them to sign in as any victim linked through the real provider. This grants attackers full account access to impersonate victims without needing their credentials.

Technologies: [Better-Auth @Better-Auth/Sso](https://junglewise.ai/threats/technologies/sso). Vendors: [Better-Auth](https://junglewise.ai/threats/vendors/better-auth).

## Quick answers

**Is CVE-2026-110863 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110863 being exploited in the wild.

**How severe is CVE-2026-110863?** High severity, with a CVSS score of 8.1, published 14 October 2026.

**Which products and versions are affected?** Better-Auth @Better-Auth/Sso 1.7.0-rc.2 before 1.7.3.

**Is there a fix for CVE-2026-110863?** Yes: fixed in 1.7.3. Until then: Block SSO sign-in at your application boundary until you can upgrade. If you have already configured resolveUser to enforce exact provider matching, the vulnerable path is blocked. Audit and remove any untrusted personal provider registrations; setting providersLimit: 0 prevents new registrations but does not disable already-registered providers. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110863 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-110863?** Check whether you run Better-Auth @Better-Auth/Sso at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.7.3

Block SSO sign-in at your application boundary until you can upgrade. If you have already configured resolveUser to enforce exact provider matching, the vulnerable path is blocked. Audit and remove any untrusted personal provider registrations; setting providersLimit: 0 prevents new registrations but does not disable already-registered providers.

## Technical details

The vulnerability is an improper authentication bypass in account lookup logic. When users sign in via a personal OIDC or SAML SSO provider, the affected versions match linked accounts using only the provider's issuer identifier and the user's subject/NameID, omitting the providerId in the lookup. An attacker can register a personal provider with the same OIDC issuer or SAML entity ID as a legitimate provider and assert a victim's account identifier, causing Better Auth to create a session for the victim's account despite the attacker controlling only the fake provider.

## Affected products

- Better Auth @better-auth/sso 1.7.0-rc.2 before 1.7.3

## Timeline

- 2026-09-29: disclosed
- 2026-10-14: advisory
- 2026-09-29: patched: Patched versions 1.7.3

## References

- [https://github.com/better-auth/better-auth/security/advisories/GHSA-mx9r-x6ww-qjw9](https://github.com/better-auth/better-auth/security/advisories/GHSA-mx9r-x6ww-qjw9)
- [https://www.vulncheck.com/advisories/better-auth-better-auth-sso-before-1.7.3-authentication-bypass-via-personal-sso-providers](https://www.vulncheck.com/advisories/better-auth-better-auth-sso-before-1.7.3-authentication-bypass-via-personal-sso-providers)