CVE-2026-67328: better-auth/sso Auth Bypass Vulnerability

CVE-2026-67328 Overview

CVE-2026-67328 affects @better-auth/sso versions before 1.6.21. The package contains multiple authentication bypass vulnerabilities in its Single Sign-On (SSO) provider handling. Attackers can sign in as arbitrary users by abusing four distinct flaws: domain verification parsing mismatches, orphaned provider accounts, unbound Security Assertion Markup Language (SAML) assertions, and reflected Cross-Site Scripting (XSS) on logout endpoints. Successful exploitation yields unauthorized session access and full account takeover. The vulnerability is tracked under [CWE-79] and carries network-reachable exploitability with low attacker privileges required.

Critical Impact
Attackers can bypass SSO authentication and take over arbitrary user accounts through multiple independent flaws in @better-auth/sso releases prior to 1.6.21.

Affected Products

@better-auth/sso versions before 1.6.21
Applications using better-auth with the SSO plugin enabled
Deployments relying on SAML or OpenID Connect (OIDC) providers via @better-auth/sso

Discovery Timeline

2026-08-01 - CVE-2026-67328 published to the National Vulnerability Database (NVD)
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67328

Vulnerability Analysis

CVE-2026-67328 aggregates four authentication bypass conditions in the @better-auth/sso provider layer. The first flaw stems from a domain verification parsing mismatch between the code that stores verified domains and the code that matches inbound identity assertions. An attacker who controls a lookalike or subdomain can satisfy one parser while the other treats the domain as verified.

The second flaw involves orphaned provider accounts. When a provider linkage is created but never bound to a canonical user, subsequent sign-ins can attach to any user record sharing the identifier. The third flaw affects SAML assertions that are accepted without being cryptographically bound to the initiating session, enabling assertion replay and injection. The fourth flaw is a reflected XSS on the logout endpoint that leaks or manipulates session state in the victim's browser.

Root Cause

The root cause is inconsistent trust validation across the SSO handshake. Domain equality checks, provider-to-user bindings, SAML InResponseTo and audience validation, and output encoding on logout responses are each handled with insufficient rigor. The reflected XSS specifically maps to [CWE-79], while the SAML and binding issues reflect broken authentication logic.

Attack Vector

Attackers reach the vulnerable endpoints over the network with only low privileges, such as an account on an attacker-controlled identity provider. By crafting a domain that parses differently across components, replaying an unbound SAML assertion, targeting an orphaned provider record, or delivering a malicious link to the logout endpoint, the attacker can authenticate as any application user. No verified public exploit code is available. See the GitHub Security Advisory and the VulnCheck Advisory for technical details.

Detection Methods for CVE-2026-67328

Indicators of Compromise

Successful SSO sign-ins where the asserted email domain does not match any previously verified tenant domain in application logs.
SAML Response messages processed without a corresponding outbound AuthnRequest or with mismatched InResponseTo identifiers.
Requests to logout endpoints containing script payloads, HTML entities, or URL-encoded <script> fragments in query parameters.
Session creation events for users who have never previously linked the SSO provider used in the current sign-in.

Detection Strategies

Audit @better-auth/sso package versions across all Node.js services and flag any install below 1.6.21.
Correlate identity provider issuer, domain, and internal user identifier on every sign-in to detect cross-tenant mismatches.
Alert on SAML assertions whose audience, recipient, or InResponseTo fields fail strict validation.
Inspect logout endpoint traffic for reflected parameters echoed into HTML responses.

Monitoring Recommendations

Ingest authentication and SSO callback logs into a centralized data lake for longitudinal analysis.
Track baseline SSO sign-in patterns per user and alert on first-time provider bindings.
Monitor Content Security Policy (CSP) violation reports originating from logout and callback paths.

How to Mitigate CVE-2026-67328

Immediate Actions Required

Upgrade @better-auth/sso to version 1.6.21 or later across all environments.
Invalidate active sessions and force re-authentication after upgrading.
Review and remove orphaned provider account records that are not bound to a canonical user.
Rotate SAML signing certificates and OIDC client secrets if compromise is suspected.

Patch Information

The maintainers fixed all four issues in @better-auth/sso version 1.6.21. Consult the GitHub Security Advisory GHSA-prpr-5gj3-qqhg for the authoritative patch notes and the VulnCheck Advisory for additional context.

Workarounds

Disable the SSO plugin until the upgrade is deployed if immediate patching is not feasible.
Enforce strict domain allowlists at the reverse proxy or identity provider layer to constrain accepted issuers.
Add a Content Security Policy that blocks inline script execution on logout and callback endpoints.
Require re-authentication or step-up verification for privileged operations to limit blast radius.

bash

# Upgrade the vulnerable package to the fixed release
npm install @better-auth/sso@1.6.21

# Verify the resolved version in the dependency tree
npm ls @better-auth/sso