Authentication Bypass in Better Auth @better-auth/sso

The Better Auth library, specifically the @better-auth/sso package, is affected by an authentication bypass vulnerability identified as CVE-2026-110863. The vulnerability exists in versions 1.7.0-rc.2 through 1.7.2. It stems from a flaw in the account lookup logic during the registration of personal SSO providers. Specifically, the system fails to validate the 'providerId' field when processing OIDC or SAML assertions. An authenticated user can configure a malicious SSO provider using the issuer URL or entity ID of a legitimate provider already associated with the target application. By asserting the 'subject' or 'NameID' of a victim user, the attacker can force the application to associate the incoming authentication event with the victim's account, effectively bypassing standard authentication controls and gaining unauthorized access to the victim's session.

Impact

Successful exploitation allows an authenticated attacker to impersonate any user within the application, leading to complete account takeover and unauthorized access to sensitive user data and administrative functions. The severity is rated at 8.1 (CVSS v3.1), reflecting the potential for significant impact on confidentiality and integrity for applications relying on the @better-auth/sso component for identity management.

Recommendation

• Upgrade the @better-auth/sso package to version 1.7.3 or later immediately.
• Audit logs for suspicious SSO provider registration events or unexpected authentication assertions involving the 'providerId' field.
• Review current SSO provider configurations for any anomalies where multiple providers share identical OIDC issuer strings or SAML entity IDs.