CVE-2026-110863: Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers
Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim's subject or NameID, because account lookup ignores providerId, creating sessions for victim accounts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already be authenticated to the affected application and able to register a personal SSO provider. They can then impersonate another user by copying a legitimate OIDC issuer or SAML entity ID and asserting the victim's subject or NameID.
Which deployments are affected?
Affected deployments use @better-auth/sso from 1.7.0-rc.2 through versions before 1.7.3 and allow personal SSO providers. The issue applies to both OIDC and SAML provider identity matching.
What should be done if an immediate upgrade is not possible?
Restrict or disable registration of personal SSO providers until the package can be updated to 1.7.3 or later. This removes the attacker capability described for exploiting the bypass.
How can defenders investigate possible exploitation?
Review personal SSO provider registrations for providers that duplicate a legitimate provider's OIDC issuer or SAML entity ID. Investigate sessions and sign-ins where the asserted subject or NameID corresponds to a different user account than the user who registered the provider.