Sso
Monthly
Two domain-ownership authentication bypass flaws in @better-auth/sso allow authenticated organization owners to compromise user account integrity via unauthorized organization assignment or identity provider hijacking. Affected versions span the stable 1.6.x line (before 1.6.27), the 1.4.x maintenance line (before 1.4.8), and the 1.7 prerelease line (before 1.7.0-rc.5). An attacker holding an org-owner role can either silently recruit users with matching email domains into an attacker-controlled organization by registering an unverified SSO provider, or exploit a race condition between verification and update endpoints to substitute a different domain after DNS proof is collected - which, combined with implicit account linking, enables effective account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis.
Multiple authentication bypass vulnerabilities in @better-auth/sso before version 1.6.21 enable low-privileged attackers to take over arbitrary user accounts via four distinct attack paths: domain verification parsing mismatches, orphaned SSO provider accounts, unbound SAML assertions, and reflected XSS on logout endpoints. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with VC:H/VI:H confirms high confidentiality and integrity impact with no availability loss. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the multiplicity of bypass vectors significantly raises the probability that any given deployment is exploitable through at least one path.
Privilege escalation in Better Auth SSO plugin (1.2.10 to <1.6.11) allows any authenticated organization member to register an attacker-controlled OIDC or SAML identity provider for the organization, bypassing the admin role check. This can be exploited to inject a malicious IdP and, through downstream SSO callback provisioning, add users to the target organization, potentially with elevated privileges if the default role is admin. The vulnerability is fixed in version 1.6.11; no active exploitation is currently reported but a public exploit is possible given the clear advisory details.
Two domain-ownership authentication bypass flaws in @better-auth/sso allow authenticated organization owners to compromise user account integrity via unauthorized organization assignment or identity provider hijacking. Affected versions span the stable 1.6.x line (before 1.6.27), the 1.4.x maintenance line (before 1.4.8), and the 1.7 prerelease line (before 1.7.0-rc.5). An attacker holding an org-owner role can either silently recruit users with matching email domains into an attacker-controlled organization by registering an unverified SSO provider, or exploit a race condition between verification and update endpoints to substitute a different domain after DNS proof is collected - which, combined with implicit account linking, enables effective account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis.
Multiple authentication bypass vulnerabilities in @better-auth/sso before version 1.6.21 enable low-privileged attackers to take over arbitrary user accounts via four distinct attack paths: domain verification parsing mismatches, orphaned SSO provider accounts, unbound SAML assertions, and reflected XSS on logout endpoints. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with VC:H/VI:H confirms high confidentiality and integrity impact with no availability loss. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the multiplicity of bypass vectors significantly raises the probability that any given deployment is exploitable through at least one path.
Privilege escalation in Better Auth SSO plugin (1.2.10 to <1.6.11) allows any authenticated organization member to register an attacker-controlled OIDC or SAML identity provider for the organization, bypassing the admin role check. This can be exploited to inject a malicious IdP and, through downstream SSO callback provisioning, add users to the target organization, potentially with elevated privileges if the default role is admin. The vulnerability is fixed in version 1.6.11; no active exploitation is currently reported but a public exploit is possible given the clear advisory details.