Is CVE-2026-80192 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-80192 being exploited in the wild.

How severe is CVE-2026-80192?

High severity, with a CVSS score of 8.1, published 26 August 2026.

Which products and versions are affected?

Better-Auth SSO before 1.6.27 (1.6.x), before 1.4.8 (1.4.x), before 1.7.0-rc.5 (1.7.x prerelease).

Is there a fix for CVE-2026-80192?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-80192 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-80192?

Check whether you run Better-Auth SSO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-80192: better-auth SSO domain ownership flaw in authentication

CVE-2026-80192 · Severity: high · CVSS 8.1 · Published 2026-08-26

@better-auth/sso is an authentication library used by applications to delegate user sign-in to identity providers like Google or other OAuth/SAML providers. This vulnerability allows attackers to gain unauthorized access to user accounts and organizations through two distinct flaws involving domain verification. An attacker could link their fake identity provider to a legitimate user's account, causing account takeover, or fraudulently add employees to an attacker-controlled organization.

Technologies: Better-Auth SSO. Vendors: Better-Auth.

Quick answers

Is CVE-2026-80192 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-80192 being exploited in the wild.
How severe is CVE-2026-80192?: High severity, with a CVSS score of 8.1, published 26 August 2026.
Which products and versions are affected?: Better-Auth SSO before 1.6.27 (1.6.x), before 1.4.8 (1.4.x), before 1.7.0-rc.5 (1.7.x prerelease).
Is there a fix for CVE-2026-80192?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-80192 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-80192?: Check whether you run Better-Auth SSO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

@better-auth/sso contains two domain ownership validation flaws affecting identity provider (IdP) registration. The first flaw occurs when domain verification is disabled: an authenticated administrator can register an SSO provider for an arbitrary domain without verification, and when users with matching email domains later sign in, they are automatically added to the attacker's organization with default member permissions. The second flaw is a race condition in the domain-verification flow: between the verify-domain and update-provider endpoints, an attacker can swap the domain being verified while DNS lookups are pending, causing completed verification to apply to a victim domain instead of the attacker's domain. When combined with implicit account linking, this allows an attacker to link an attacker-controlled IdP to an existing user account. Both flaws require the SSO plugin to be enabled; the organization-assignment path additionally requires the organization plugin. Patches are available in versions 1.6.27, 1.4.8, and 1.7.0-rc.5 depending on the release line.

Affected products

better-auth SSO before 1.6.27 (1.6.x), before 1.4.8 (1.4.x), before 1.7.0-rc.5 (1.7.x prerelease)

Timeline

2026-08-11: disclosed
2026-08-26: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.