Authentication Bypass in Better Auth SSO from Better Auth

CVE-2026-110863

What is CVE-2026-110863?

The Better Auth SSO prior to version 1.7.3 possesses an authentication bypass vulnerability that enables authenticated users to impersonate other users. By registering a personal SSO provider, attackers can replicate a legitimate provider's OIDC issuer or SAML entity ID and assert a victim's subject or NameID. This vulnerability arises from inadequate account verification that neglects to consider providerId, thereby allowing attackers to create active sessions for victim accounts, which can lead to unauthorized access and data exfiltration.

References