Read the docs
TI-2026-55433 Aliases CVE-2026-80192GHSA-xfj7-7fp8-rhvp

better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass

Priority LOW 39CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

@better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line) contains two domain-ownership flaws. When domain verification is disabled, automatic organization assignment accepts unverified provider domains, allowing an authenticated organization owner/administrator to register an SSO provider for an arbitrary domain and have users with matching email domains added to the attacker's organization with default member permissions. When domain verification is enabled, a race condition between the verify-domain and update-provider endpoints can apply completed DNS proof to a different domain; combined with implicit account linking, this can link an attacker-controlled identity provider to an existing user account. Exploitation requires the SSO plugin (and, for the org-assignment path, the organization plugin) with the relevant configuration enabled.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00363 30th percentileScored 2026-11-07
Fix Fixed sso (better-auth): 1.4.8, 1.6.27, 1.7.0-rc.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
better-authsso1.4.8-beta.1 to before 1.4.81.4.8Patch availableCNA
better-authsso1.4.9 to before 1.6.271.6.27Patch availableCNA
better-authsso1.7.0-beta.0 to before 1.7.0-rc.51.7.0-rc.5Patch availableCNA
  • sso Vendorbetter-auth Affected 1.4.8-beta.1 to before 1.4.8 Fixed in 1.4.8 Patch available CNA
  • sso Vendorbetter-auth Affected 1.4.9 to before 1.6.27 Fixed in 1.6.27 Patch available CNA
  • sso Vendorbetter-auth Affected 1.7.0-beta.0 to before 1.7.0-rc.5 Fixed in 1.7.0-rc.5 Patch available CNA

Remediation

  • Fix · CNA sso (better-auth) Fixed in 1.4.8
  • Fix · CNA sso (better-auth) Fixed in 1.6.27
  • Fix · CNA sso (better-auth) Fixed in 1.7.0-rc.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-80192
  2. 2026-10-03 Alias added: GHSA-xfj7-7fp8-rhvp

References

Advisory 1

  • TI-2025-38277 Better Auth: Unauthenticated API key creation through api-key plugin CVSS 4.0CRITICAL 9.3
  • TI-2026-47627 better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass CVSS 4.0HIGH 8.7
  • TI-2025-20000 Beter Auth has an Open Redirect via Scheme-Less Callback Parameter CVSS 4.0MEDIUM 6.9
  • TI-2026-13066 better-auth better-icons scan_project_icons/sync_icon path traversal CVSS 4.0MEDIUM 4.8
  • TI-2026-79320 OAuth state accepted as Magic Link token in Better Auth CVSS 3.1CRITICAL 9.1
  • TI-2026-74552 Authentication bypass in Better Auth Magic Link verification CVSS 4.0CRITICAL 9.3
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences