better-auth/sso CVE-2026-67328

Exploitation requires the target application to have the @better-auth/sso plugin installed and actively configured with at least one SSO identity provider. The CVSS 4.0 PR:L metric confirms the attacker must possess at minimum a low-privilege presence in the system (e.g., a valid registered account or access to a linked identity provider). Four distinct exploitation paths exist with differing sub-conditions: the SAML unbound assertion path requires a SAML provider to be configured; the domain verification mismatch path applies when the application uses domain-restricted SSO enrollment; the orphaned account path requires that previously deprovisioned SSO-linked accounts still exist in the database; and the reflected XSS path on logout endpoints requires that a victim with an active session can be socially directed to a crafted logout URL. Applications using Better Auth exclusively with password-based authentication (no SSO plugin) are not affected. No special platform or OS conditions are identified.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) signals high real-world severity: the attack is network-reachable, requires no complex preconditions (AC:L, AT:N), demands no user interaction, and yields full read/write account-level impact. PR:L indicates at least low-privilege authenticated presence is required, which marginally limits exposure compared to unauthenticated attacks but does not significantly constrain real-world risk - any registered user in a multi-tenant deployment could elevate to arbitrary account control. No EPSS data was provided in the intelligence feed, and this CVE is not listed in the CISA KEV catalog, meaning active exploitation is not confirmed. VulnCheck is the reporting entity, and no public POC has been identified at time of analysis. The four independent bypass mechanisms are the most significant risk multiplier: even if one path is mitigated by a particular deployment configuration (e.g., no SAML in use), the others may remain viable. Organizations using the beta track (1.7.0-beta.0 through pre-1.7.0-beta.10) are equally exposed.

An attacker holding a low-privilege account on a Better Auth application with SSO enabled crafts a SAML response with an assertion that is not cryptographically bound to the originating authentication request, targeting a high-value user account. The vulnerable library accepts the unbound assertion and issues a session token for the victim account, granting the attacker full account control. Alternatively, the attacker delivers a reflected XSS payload via the logout endpoint to a logged-in victim, stealing their active session cookie without requiring direct exploitation of the SAML logic. No public POC has been identified at time of analysis, but the variety of attack paths means a determined attacker has multiple independent avenues to attempt.