Executive brief
@better-auth/sso is an authentication library used by applications to delegate user sign-in to identity providers like Google or other OAuth/SAML providers. This vulnerability allows attackers to gain unauthorized access to user accounts and organizations through two distinct flaws involving domain verification. An attacker could link their fake identity provider to a legitimate user's account, causing account takeover, or fraudulently add employees to an attacker-controlled organization.
Technical details
@better-auth/sso contains two domain ownership validation flaws affecting identity provider (IdP) registration. The first flaw occurs when domain verification is disabled: an authenticated administrator can register an SSO provider for an arbitrary domain without verification, and when users with matching email domains later sign in, they are automatically added to the attacker's organization with default member permissions. The second flaw is a race condition in the domain-verification flow: between the verify-domain and update-provider endpoints, an attacker can swap the domain being verified while DNS lookups are pending, causing completed verification to apply to a victim domain instead of the attacker's domain. When combined with implicit account linking, this allows an attacker to link an attacker-controlled IdP to an existing user account. Both flaws require the SSO plugin to be enabled; the organization-assignment path additionally requires the organization plugin. Patches are available in versions 1.6.27, 1.4.8, and 1.7.0-rc.5 depending on the release line.
Affected products
- better-auth SSO before 1.6.27 (1.6.x), before 1.4.8 (1.4.x), before 1.7.0-rc.5 (1.7.x prerelease)
Timeline
- 2026-08-11: disclosed
- 2026-08-26: advisory