Executive brief
@better-auth/sso is a library that allows applications to implement single sign-on (SSO) authentication via third-party identity providers. Four separate vulnerabilities in how the library validates SSO provider credentials allow attackers to bypass authentication and hijack user accounts, including admin accounts, without any action from the victim. This represents complete account takeover with potential privilege escalation.
Technical details
@better-auth/sso contains four distinct authentication bypass flaws in SSO provider validation: (1) domain verification parsing mismatch where a crafted domain like "https://attacker.com/path,victim.com" validates for attacker.com but trusts victim.com at sign-in; (2) orphaned provider accounts where deleted SSO provider links remain in the database, allowing re-registration and account hijacking; (3) unbound SAML assertions that lack Audience/Recipient/Destination validation, allowing signed assertions meant for other service providers to be accepted; (4) reflected XSS on SAML logout endpoints where unvalidated provider metadata URLs with javascript: or data: schemes execute attacker code. Exploitation requires self-service SSO registration enabled and implicit account linking active (both default). No victim interaction is needed. Patches are available in versions 1.6.21 and 1.7.0-beta.10.
Affected products
- better-auth sso before 1.6.21, and 1.7.0-beta.0 through 1.7.0-beta.9
Timeline
- 2026-06-26: disclosed
- 2026-06-26: patched
- 2026-08-01: advisory