Domain Ownership Flaws in Better-Auth SSO Product

CVE-2026-80192

What is CVE-2026-80192?

The Better-Auth SSO plugin prior to version 1.6.27 contains critical domain ownership issues. With domain verification disabled, authenticated organization administrators can register an SSO provider for any domain, allowing them to add users with matching email addresses to their organization with default permissions. Additionally, when domain verification is enabled, a race condition can result in DNS proof being applied inaccurately, linking an attacker-controlled identity provider to legitimate user accounts, especially if account linking is enabled with the relevant configuration.

References