better-auth SSO EUVD-2026-66214

Path 1 (unverified-domain org-assignment): domain verification must be explicitly disabled in the SSO plugin configuration; both the SSO plugin and the organization plugin must be active; the attacker must hold an authenticated organization owner or administrator role. Exploitation is passive - users with email domains matching the claimed provider domain are auto-assigned upon their next SSO authentication, requiring no direct interaction from the victim. Path 2 (race condition plus account linking): domain verification must be enabled; implicit account linking must be active in the SSO plugin; the attacker must hold an authenticated organization owner role and be able to issue precisely timed concurrent API requests to the verify-domain and update-provider endpoints. Exploitation is further limited to user accounts whose email domains are not already locked to a separately verified provider. Both paths require the SSO plugin to be installed and configured; the org-assignment path additionally requires the organization plugin.

The vendor-assigned CVSS 4.0 score of 8.6 (High) is consistent with both attack paths: network-accessible exploitation requiring only an authenticated org-owner role (PR:L), with high confidentiality and integrity impact and no availability dimension. The simpler path - exploiting disabled domain verification - carries low practical complexity and is viable without specialized tooling. The race condition path requires concurrent API requests with precise timing, raising real-world complexity, but remains feasible for a motivated attacker who controls their environment. No EPSS data was supplied and no CISA KEV listing or public POC exists at time of analysis, which reduces immediate mass-exploitation risk; however, the account-takeover potential via the race condition path means that any organization running implicit account linking with this plugin should treat this as an urgent patch rather than a deferred maintenance item. The authenticated-only prerequisite (org-owner role) limits the attacker population relative to the raw CVSS score, and risk is further bounded by whether implicit account linking is active - defenders who have neither feature enabled face a substantially lower effective risk profile than the base score implies.

An attacker holding an org-owner role registers an SSO provider claiming the domain 'victim-corp.com' without possessing DNS control over it; when a user with a @victim-corp.com address next authenticates, the system automatically assigns them to the attacker's organization with default member permissions, exposing internal organizational resources. Alternatively, the attacker initiates a legitimate domain verification flow for their own domain, then races a concurrent update-provider request to swap in a different target domain before the DNS proof is applied, and with implicit account linking active, the attacker's identity provider becomes linked to an existing user's account, enabling authentication impersonation. No public POC code has been identified, but the org-assignment path is mechanically straightforward given an authenticated org-owner role.