EUVD-2026-51839
GHSA-8g2f-78cq-p655
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L confirmed by CVSS 4.0 input; S:U chosen because primary impact (account takeover) remains within the application scope despite the XSS sub-vector.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints to gain unauthorized session access and account takeover.
AnalysisAI
Multiple authentication bypass vulnerabilities in @better-auth/sso before version 1.6.21 enable low-privileged attackers to take over arbitrary user accounts via four distinct attack paths: domain verification parsing mismatches, orphaned SSO provider accounts, unbound SAML assertions, and reflected XSS on logout endpoints. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with VC:H/VI:H confirms high confidentiality and integrity impact with no availability loss. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target application to have the @better-auth/sso plugin installed and actively configured with at least one SSO identity provider. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) signals high real-world severity: the attack is network-reachable, requires no complex preconditions (AC:L, AT:N), demands no user interaction, and yields full read/write account-level impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a low-privilege account on a Better Auth application with SSO enabled crafts a SAML response with an assertion that is not cryptographically bound to the originating authentication request, targeting a high-value user account. The vulnerable library accepts the unbound assertion and issues a session token for the victim account, granting the attacker full account control. … |
| Remediation | Upgrade @better-auth/sso to version 1.6.21 or later on the stable track, or to 1.7.0-beta.10 or later on the beta track, per the vendor advisory GHSA-prpr-5gj3-qqhg at https://github.com/better-auth/better-auth/security/advisories/GHSA-prpr-5gj3-qqhg. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all systems using @better-auth/sso and identify which environments are running vulnerable versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Two domain-ownership authentication bypass flaws in @better-auth/sso allow authenticated organization owners to compromi
Privilege escalation in Better Auth SSO plugin (1.2.10 to <1.6.11) allows any authenticated organization member to regis
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today