Attack Chain

1. The attacker identifies an application utilizing a vulnerable version of @better-auth/sso.
2. The attacker initiates an authentication request to the SSO provider.
3. The attacker intercepts or modifies the response, exploiting domain verification parsing mismatches or injecting an unbound SAML assertion.
4. Alternatively, the attacker triggers a reflected XSS on the logout endpoint to steal session identifiers or manipulate session state.
5. The @better-auth/sso library incorrectly validates the forged or manipulated SSO assertion.
6. The application grants the attacker an authenticated session associated with the target user's identity.
7. The attacker accesses the application as the target user, achieving unauthorized access or complete account takeover.

Impact

Successful exploitation leads to unauthorized access to user accounts, enabling attackers to view private data, perform unauthorized actions on behalf of users, or elevate privileges if the account is an administrator. This impacts all applications and services that rely on the @better-auth/sso library for authentication, potentially exposing thousands of user sessions depending on the scale of the deployment.

Recommendation

Prioritized actions for development and security teams:

• Upgrade @better-auth/sso to version 1.6.21 or 1.7.0-beta.10 immediately to remediate the vulnerabilities.
• Review authentication logs for unusual session activity or authentication requests originating from unexpected SSO providers.
• Audit custom authentication logic that integrates with @better-auth/sso to ensure strict validation of SAML assertions and SSO responses.
• Implement monitoring for XSS patterns on logout endpoints as a compensatory measure while patching.