High priorityDisclosed

Advisory · CVE-2026-110863

Better Auth SSO plugin lets authenticated users impersonate other accounts

The Better Auth SSO package from 1.7.0-rc.2 before 1.7.3 lets an authenticated user register a personal SSO provider and sign in as another user. CVSS 3.1 8.1, CVSS 4.0 8.6.

Advisory published October 15, 2026Independent summary
Vendor
Better Auth
Product
Better Auth SSO
Identifier / CWE
CVE-2026-110863
CWE-287
Action timing
Immediate
ELI5

Explain it like I’m five

A user can set up their own identity desk, copy the stamp of a trusted desk, and get waved through as somebody else.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Personal provider registered

    An authenticated attacker registers a personal SSO provider in the affected package.

  2. 02Trusted identity copied

    The provider copies the OIDC issuer or SAML entity ID of a legitimate provider.

  3. 03Victim identity asserted

    The attacker asserts a victim subject or NameID through that provider.

  4. 04Wrong account matched

    Account lookup ignores the provider identifier, so a session is created for the victim account.

What happened

The GitHub advisory for Better Auth describes an authentication bypass in the SSO package from 1.7.0-rc.2 before 1.7.3. Authenticated users can register a personal SSO provider.

Because account lookup ignores the provider identifier, a personal provider that copies a legitimate provider issuer or entity ID and asserts a victim subject or NameID can produce a session for the victim account.

What to do

  1. Inventory applications using the Better Auth SSO package and personal SSO providers.
  2. Upgrade the SSO package to 1.7.3 or later using the project advisory guidance.
  3. Disable or tightly restrict personal SSO provider registration until the upgrade is in place.
  4. Review provider registrations and SSO sign-ins for duplicate issuers or entity IDs and for sign-ins outside a user normal pattern.
  5. Invalidate sessions created through suspicious providers and verify the deployed version after patching.

Management note

This needs an existing account, which lowers reach but not impact: one low-privilege user can become another user. Audit provider registrations as carefully as the patch itself.