CVE-2026-80192 Overview
CVE-2026-80192 affects the @better-auth/sso plugin in versions before 1.6.27, before 1.4.8 in the 1.4.x line, and before 1.7.0-rc.5 in the 1.7 prerelease line. The vulnerability comprises two distinct domain-ownership flaws that undermine Single Sign-On (SSO) trust boundaries. When domain verification is disabled, automatic organization assignment accepts unverified provider domains. When domain verification is enabled, a race condition between the verify-domain and update-provider endpoints allows completed DNS proof to be applied to a different domain. Combined with implicit account linking, an attacker can link an attacker-controlled identity provider to an existing user account.
Critical Impact
An authenticated organization owner or administrator can hijack users with matching email domains into an attacker-controlled organization, or link an attacker-controlled identity provider to an existing user account, resulting in account takeover.
Affected Products
- @better-auth/sso versions before 1.6.27
- @better-auth/sso 1.4.x versions before 1.4.8
- @better-auth/sso 1.7 prerelease versions before 1.7.0-rc.5
Discovery Timeline
- 2026-08-26 - CVE-2026-80192 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-80192
Vulnerability Analysis
The flaw is classified under [CWE-287] Improper Authentication. It manifests along two distinct exploitation paths tied to the plugin's domain verification configuration. Both paths abuse the trust the plugin extends to SSO provider domain claims.
In the first path, when domain verification is disabled, the plugin's automatic organization assignment logic accepts an unverified provider domain at face value. An authenticated organization owner or administrator can register an SSO provider for any domain they do not own. Any user whose email domain matches is then automatically added to the attacker's organization with default member permissions.
In the second path, when domain verification is enabled, a race condition exists between the verify-domain endpoint and the update-provider endpoint. An attacker can complete a legitimate DNS proof for one domain and, by racing the update, cause the completed proof to be applied to a different, attacker-chosen domain. Combined with implicit account linking, the attacker links a fraudulent identity provider to an existing user account.
Root Cause
The root cause is insufficient binding between domain-ownership proof and the provider record it authorizes. The verify-domain and update-provider endpoints operate on shared state without atomic guarantees, and the automatic organization assignment path lacks a mandatory verification precondition.
Attack Vector
Exploitation requires network access and an authenticated account with organization owner or administrator privileges. The SSO plugin must be enabled, and the organization plugin must be enabled for the org-assignment path. No user interaction is required. See the GitHub Security Advisory GHSA-8c5h-wx78-2cfg and the VulnCheck Advisory on Authentication Bypass for the maintainer's technical description.
Detection Methods for CVE-2026-80192
Indicators of Compromise
- SSO provider registrations from organization owners or administrators referencing domains that do not match the organization's owned domains.
- Users unexpectedly appearing as members of organizations they did not join, particularly where the email domain matches a newly registered SSO provider.
- Successful verify-domain calls closely followed by update-provider calls that change the associated domain within a short time window.
- New identity provider links on established user accounts without a corresponding user-initiated linking action.
Detection Strategies
- Audit the SSO provider table for provider records whose domain does not appear in the organization's verified domain inventory.
- Correlate authentication and provisioning logs to flag organization membership changes that stem from automatic assignment rather than explicit invitation.
- Instrument the verify-domain and update-provider endpoints to log request identifiers, timestamps, and resulting domain bindings for post-hoc race analysis.
Monitoring Recommendations
- Alert on any change in the domain field of an existing SSO provider record.
- Alert on account-linking events where the linked identity provider was registered within the past 24 hours.
- Track the rate of new SSO provider registrations per organization owner and threshold-alert on anomalies.
How to Mitigate CVE-2026-80192
Immediate Actions Required
- Upgrade @better-auth/sso to 1.6.27, 1.4.8, or 1.7.0-rc.5 or later, matching the release line in use.
- Audit all SSO provider records and revoke providers whose domain ownership cannot be confirmed.
- Review recent organization membership changes and remove accounts added through automatic assignment against unverified domains.
- Review account-linking events since the plugin was deployed and unlink identity providers that lack a legitimate user action.
Patch Information
The maintainer released fixes in @better-auth/sso 1.6.27, 1.4.8, and 1.7.0-rc.5. Refer to the GitHub Security Advisory GHSA-8c5h-wx78-2cfg for patch commits and upgrade notes.
Workarounds
- Disable the SSO plugin, or disable automatic organization assignment, until upgrading is possible.
- Disable implicit account linking so that new identity providers cannot attach to existing accounts without explicit confirmation.
- Require manual administrator review before any SSO provider becomes active for provisioning.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
