EUVD-2026-101746

Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim'...

CVE-2026-110863

Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim'...

CVE-2026-110863

The @better-auth/sso library (versions 1.7.0-rc.2 before 1.7.3 ) contains an authentication bypass vulnerability. The root cause is that the account lookup mechanism ignores the providerId , allowing an authenticated attacker to register a personal SSO provider using a legitimate provider's OIDC ...

CVE-2026-110863 Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers

Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim'...

CVE-2026-110863 Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers

Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim'...

EUVD-2026-66214

@better-auth/sso before 1.6.27 and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line contains two domain-ownership flaws. When domain verification is disabled, automatic organization assignment accepts unverified provider domains, allowing an authenticated organizati...

CVE-2026-80192

@better-auth/sso before 1.6.27 and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line contains two domain-ownership flaws. When domain verification is disabled, automatic organization assignment accepts unverified provider domains, allowing an authenticated organizati...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview @better-auth/sso is a SSO plugin for Better Auth Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition through the verifyDomain route in packages/sso/src/routes/domain-verification.ts and the domain-based assignment logic in...

@arxen/sso (0.2.0), @inkeep/agents-api (>=0.0.0-dev-20260121145510, <=0.80.7) +20 more potentially affected by CVE-2026-80192 via @better-auth/sso (>=1.4.10, <=1.6.26)

@better-auth/sso NPM version =1.4.10, =0.0.0-dev-20260121145510, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260106221934, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260203033642...

CVE-2026-80192: Improper Authentication

@better-auth/sso before 1.6.27 and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line contains two domain-ownership flaws. When domain verification is disabled, automatic organization assignment accepts unverified provider domains, allowing an authenticated organizati...

CVE-2026-80192 better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass

@better-auth/sso before 1.6.27 and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line contains two domain-ownership flaws. When domain verification is disabled, automatic organization assignment accepts unverified provider domains, allowing an authenticated organizati...

CVE-2026-80192

@better-auth/sso contains two domain-ownership authentication bypass flaws affecting versions before 1.6.27 (and before 1.4.8 in the 1.4.x line, before 1.7.0-rc.5 in the 1.7 prerelease line). When domain verification is disabled , an authenticated organization owner/administrator can register an ...

CVE-2026-80192 better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass

@better-auth/sso before 1.6.27 and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line contains two domain-ownership flaws. When domain verification is disabled, automatic organization assignment accepts unverified provider domains, allowing an authenticated organizati...

CVE-2026-80192

@better-auth/sso before 1.6.27 and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line contains two domain-ownership flaws. When domain verification is disabled, automatic organization assignment accepts unverified provider domains, allowing an authenticated organizati...

CVE-2026-80192 better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass

@better-auth/sso before 1.6.27 and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line contains two domain-ownership flaws. When domain verification is disabled, automatic organization assignment accepts unverified provider domains, allowing an authenticated organizati...

PT-2026-81905

Name of the Vulnerable Software and Affected Versions @better-auth/sso versions prior to 1.4.8 @better-auth/sso versions prior to 1.6.27 @better-auth/sso versions prior to 1.7.0-rc.5 Description Two domain-ownership flaws exist when the SSO plugin is active. If domain verification is disabled,...

@inkeep/agents-api (>=0.0.0-dev-20260121145510, <=0.80.7), @inkeep/agents-cli (>=0.0.0-chat-to-edit-20251119071712, <=0.80.7) +17 more potentially affected by CVE-2026-67328 via @better-auth/sso (>=1.3.28, <=1.6.20)

@better-auth/sso NPM version =1.3.28, =0.0.0-dev-20260121145510, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260106221934, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260203033642...

CVE-2026-67328: Improper Neutralization of Input During Web Page Generation

@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflect...

@inkeep/agents-api (>=0.0.0-dev-20260121145510, <=0.79.1), @inkeep/agents-cli (>=0.0.0-chat-to-edit-20251119071712, <=0.79.1) +17 more potentially affected by CVE-2026-53515 via @better-auth/sso (>=1.3.28, <=1.6.9)

@better-auth/sso NPM version =1.3.28, =0.0.0-dev-20260121145510, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260106221934, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260203033642...

@inkeep/agents-api (>=0.0.0-dev-20260121145510, <=0.79.1), @inkeep/agents-cli (>=0.0.0-chat-to-edit-20251119071712, <=0.79.1) +17 more potentially affected by CVE-2026-53515 via @better-auth/sso (>=1.3.28, <=1.6.9)

@better-auth/sso NPM version =1.3.28, =0.0.0-dev-20260121145510, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260106221934, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260203033642...