Better Auth @better-auth/sso: Authentication bypass via personal SSO providers

Summary

The SSO plugin of the Better Auth library lets signed-in users register personal OIDC or SAML providers. Affected versions look up linked accounts by provider issuer or entity ID and the asserted subject or NameID, but do not check the providerId. An authenticated attacker can copy a legitimate provider's issuer or entity ID and sign in as another user, which creates a session for the victim's account. Exposure exists only where an application uses @better-auth/sso with self-service provider registration and without resolveUser configured.

Affected

• @better-auth/sso from 1.7.0-rc.2 before 1.7.3 (CVE record: >= 1.7.0-rc.2, < 1.7.3)
• Vendor advisory lists 1.7.0-rc.2 through 1.7.0-rc.6 and 1.7.0 through 1.7.2 as affected
• Default configuration: unaffected according to the CVE record

Fixed in

• Upgrade to @better-auth/sso 1.7.3 or later
• Better Auth supports only the latest version; the current latest release is recommended, as later SSO fixes exist
• Unknown: exact current latest version number (not verified)

Workaround

• The vendor advisory states that upgrading is the recommended fix.
• If an upgrade is not possible, block SSO sign-in at the application boundary.
• Setting providersLimit: 0 only prevents new personal-provider registrations; existing providers stay usable.
• Configuring resolveUser with an exact provider match blocks the affected path.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• Not listed in CISA KEV.
• No public proof of concept found and no reports of in-the-wild exploitation.
• VulDB assesses exploitation as easy; this is an assessment, not evidence of exploitation.

Our recommendation

• Check dependency manifests and lockfiles (npm, pnpm, yarn) for @better-auth/sso, including vendor-supplied applications.
• Upgrade to 1.7.3 at minimum and prefer the current latest release.
• Until patched, disable self-service SSO provider registration if the application allows it.
• Review existing SSO provider records for unexpected personal providers and review sign-ins for cross-account activity.
• Treat the whole @better-auth/sso package as a patching priority, as several SSO flaws were published in 2026.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-mx9r-x6ww-qjw9 github.com
• VulnCheck advisory: Better Auth @better-auth/sso before 1.7.3 www.vulncheck.com
• GitHub Security Advisory GHSA-prpr-5gj3-qqhg (related SSO flaws) github.com
• OpenCVE: CVE-2026-110863 app.opencve.io
• Better Auth security overview github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:07.