better-auth SSO CVE-2026-80192
HIGHSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with org-owner role (PR:L); scope changes because victim users' accounts in downstream components are compromised, warranting S:C.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
@better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line) contains two domain-ownership flaws. When domain verification is disabled, automatic organization assignment accepts unverified provider domains, allowing an authenticated organization owner/administrator to register an SSO provider for an arbitrary domain and have users with matching email domains added to the attacker's organization with default member permissions. When domain verification is enabled, a race condition between the verify-domain and update-provider endpoints can apply completed DNS proof to a different domain; combined with implicit account linking, this can link an attacker-controlled identity provider to an existing user account. Exploitation requires the SSO plugin (and, for the org-assignment path, the organization plugin) with the relevant configuration enabled.
AnalysisAI
Two domain-ownership authentication bypass flaws in @better-auth/sso allow authenticated organization owners to compromise user account integrity via unauthorized organization assignment or identity provider hijacking. Affected versions span the stable 1.6.x line (before 1.6.27), the 1.4.x maintenance line (before 1.4.8), and the 1.7 prerelease line (before 1.7.0-rc.5). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Path 1 (unverified-domain org-assignment): domain verification must be explicitly disabled in the SSO plugin configuration; both the SSO plugin and the organization plugin must be active; the attacker must hold an authenticated organization owner or administrator role. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 4.0 score of 8.6 (High) is consistent with both attack paths: network-accessible exploitation requiring only an authenticated org-owner role (PR:L), with high confidentiality and integrity impact and no availability dimension. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding an org-owner role registers an SSO provider claiming the domain 'victim-corp.com' without possessing DNS control over it; when a user with a @victim-corp.com address next authenticates, the system automatically assigns them to the attacker's organization with default member permissions, exposing internal organizational resources. Alternatively, the attacker initiates a legitimate domain verification flow for their own domain, then races a concurrent update-provider request to swap in a different target domain before the DNS proof is applied, and with implicit account linking active, the attacker's identity provider becomes linked to an existing user's account, enabling authentication impersonation. … |
| Remediation | Upgrade @better-auth/sso to version 1.6.27 or later (stable), 1.4.8 or later (1.4.x pins), or 1.7.0-rc.5 or later (prerelease). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory systems running @better-auth/sso and identify deployed versions via package.json and npm audit; audit organization-owner role assignments and review SSO provider configuration changes for suspicious activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Multiple authentication bypass vulnerabilities in @better-auth/sso before version 1.6.21 enable low-privileged attackers
Privilege escalation in Better Auth SSO plugin (1.2.10 to <1.6.11) allows any authenticated organization member to regis
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today