---
id: CVE-2026-67328
title: >-
  @better-auth/sso versions before 1.6.21 contain multiple authentication bypass
  vulnerabilities in SSO provider handling that allow attackers to sign in as
  arbitrary users
summary: >-
  @better-auth/sso versions before 1.6.21 contain multiple authentication bypass
  vulnerabilities in SSO provider handling that allow attackers to sign in as
  arbitrary users. Attackers can exploit domain verification parsing mismatches,
  orp…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-79
vendor: better-auth
product: sso
affected:
  - sso < 1.6.21
  - sso >= 1.7.0-beta.0 < 1.7.0-beta.10
published: '2026-08-01'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T16:17:31.307'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67328'
references:
  - url: >-
      https://github.com/better-auth/better-auth/security/advisories/GHSA-prpr-5gj3-qqhg
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/better-auth-sso-before-account-takeover-via-sso
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-08-03T19:39:11.641219Z'
epss: 0.00491
epssPercentile: 0.42019
ingestedAt: '2026-08-02T07:18:02.367Z'
---

## Overview

@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints to gain unauthorized session access and account takeover.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.