{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3abetter-authbetter-authnode.js/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:better-auth:better-auth:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-110863"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@better-auth/sso (1.7.0-rc.2 to 1.7.2)"],"_cs_severities":["high"],"_cs_tags":["authentication-bypass","identity-management","cve-2026-110863"],"_cs_type":"advisory","_cs_vendors":["Better Auth"],"content_html":"\u003cp\u003eThe Better Auth library, specifically the @better-auth/sso package, is affected by an authentication bypass vulnerability identified as CVE-2026-110863. The vulnerability exists in versions 1.7.0-rc.2 through 1.7.2. It stems from a flaw in the account lookup logic during the registration of personal SSO providers. Specifically, the system fails to validate the 'providerId' field when processing OIDC or SAML assertions. An authenticated user can configure a malicious SSO provider using the issuer URL or entity ID of a legitimate provider already associated with the target application. By asserting the 'subject' or 'NameID' of a victim user, the attacker can force the application to associate the incoming authentication event with the victim's account, effectively bypassing standard authentication controls and gaining unauthorized access to the victim's session.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated attacker to impersonate any user within the application, leading to complete account takeover and unauthorized access to sensitive user data and administrative functions. The severity is rated at 8.1 (CVSS v3.1), reflecting the potential for significant impact on confidentiality and integrity for applications relying on the @better-auth/sso component for identity management.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the @better-auth/sso package to version 1.7.3 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit logs for suspicious SSO provider registration events or unexpected authentication assertions involving the 'providerId' field.\u003c/li\u003e\n\u003cli\u003eReview current SSO provider configurations for any anomalies where multiple providers share identical OIDC issuer strings or SAML entity IDs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T02:34:09Z","date_published":"2026-10-15T02:34:09Z","id":"https://feed.craftedsignal.io/briefs/2026-10-better-auth-sso-bypass/","summary":"Better Auth @better-auth/sso versions 1.7.0-rc.2 through 1.7.2 contain an authentication bypass vulnerability allowing attackers to impersonate other users via malicious SSO provider registration.","title":"Authentication Bypass in Better Auth @better-auth/sso","url":"https://feed.craftedsignal.io/briefs/2026-10-better-auth-sso-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:better-Auth:better-Auth:*:*:*:*:*:node.js:*:*","version":"https://jsonfeed.org/version/1.1"}