CVE-2026-110863 Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers

Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim'...

CVE-2026-110863

The @better-auth/sso library (versions 1.7.0-rc.2 before 1.7.3 ) contains an authentication bypass vulnerability. The root cause is that the account lookup mechanism ignores the providerId , allowing an authenticated attacker to register a personal SSO provider using a legitimate provider's OIDC ...

CVE-2026-110863

Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim'...

PT-2026-114177

Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim'...

CVE-2026-110863: Improper Authentication

Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim'...