CVE-2026-110863

8.1High

Published 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

8.1High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality, integrity
Weakness: CWE-287

Impact

Authenticated attackers can hijack any user session and sign in as that user. They only need a standard account to register a malicious personal SSO provider spoofing a legitimate provider's issuer or entity ID.

Root cause

The SSO account lookup ignores providerId during authentication, allowing personal SSO providers to match and validate victim sessions using cloned subject or NameID values.

Affected systems

Better Auth @better-auth/sso version 1.7.0-rc.2 before 1.7.3

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Fix & remediation

Upgrade @better-auth/sso to version 1.7.3 or later. If patching immediately is not possible, disable or restrict personal SSO provider registration in your configuration.

shell

$ npm install @better-auth/sso@^1.7.3

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim's subject or NameID, because account lookup ignores providerId, creating sessions for victim accounts.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110863