Description
Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim's subject or NameID, because account lookup ignores providerId, creating sessions for victim accounts.
Published: 2026-10-14
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Description Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim's subject or NameID, because account lookup ignores providerId, creating sessions for victim accounts.
Title Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers
First Time appeared Better-auth
Better-auth better-auth\/sso
Weaknesses CWE-287
CPEs cpe:2.3:a:better-auth:better-auth\/sso:*:*:*:*:*:*:*:*
Vendors & Products Better-auth
Better-auth better-auth\/sso
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Better-auth Better-auth\/sso
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-16T17:14:33.345Z

Reserved: 2026-10-14T22:18:33.239Z

Link: CVE-2026-110863

cve-icon Vulnrichment

Updated: 2026-10-16T16:35:49.658Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T23:17:27.830

Modified: 2026-10-16T18:17:34.130

Link: CVE-2026-110863

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-15T12:30:04Z

Weaknesses