Is CVE-2026-67328 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67328 being exploited in the wild.

How severe is CVE-2026-67328?

High severity, with a CVSS score of 8.1, published 1 August 2026.

Which products and versions are affected?

Better-Auth SSO before 1.6.21, and 1.7.0-beta.0 through 1.7.0-beta.9.

Is there a fix for CVE-2026-67328?

A patch was published on 2026-06-26. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67328 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-67328?

Check whether you run Better-Auth SSO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67328: better-auth SSO multiple authentication bypass vulnerabilities

CVE-2026-67328 · Severity: high · CVSS 8.1 · Published 2026-08-01

@better-auth/sso is a library that allows applications to implement single sign-on (SSO) authentication via third-party identity providers. Four separate vulnerabilities in how the library validates SSO provider credentials allow attackers to bypass authentication and hijack user accounts, including admin accounts, without any action from the victim. This represents complete account takeover with potential privilege escalation.

Technologies: Better-Auth SSO. Vendors: Better-Auth.

Quick answers

Is CVE-2026-67328 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67328 being exploited in the wild.
How severe is CVE-2026-67328?: High severity, with a CVSS score of 8.1, published 1 August 2026.
Which products and versions are affected?: Better-Auth SSO before 1.6.21, and 1.7.0-beta.0 through 1.7.0-beta.9.
Is there a fix for CVE-2026-67328?: A patch was published on 2026-06-26. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67328 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-67328?: Check whether you run Better-Auth SSO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

@better-auth/sso contains four distinct authentication bypass flaws in SSO provider validation: (1) domain verification parsing mismatch where a crafted domain like "https://attacker.com/path,victim.com" validates for attacker.com but trusts victim.com at sign-in; (2) orphaned provider accounts where deleted SSO provider links remain in the database, allowing re-registration and account hijacking; (3) unbound SAML assertions that lack Audience/Recipient/Destination validation, allowing signed assertions meant for other service providers to be accepted; (4) reflected XSS on SAML logout endpoints where unvalidated provider metadata URLs with javascript: or data: schemes execute attacker code. Exploitation requires self-service SSO registration enabled and implicit account linking active (both default). No victim interaction is needed. Patches are available in versions 1.6.21 and 1.7.0-beta.10.

Affected products

better-auth sso before 1.6.21, and 1.7.0-beta.0 through 1.7.0-beta.9

Timeline

2026-06-26: disclosed
2026-06-26: patched
2026-08-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.