High severity · published Oct 14, 2026
CVE-2026-110863
Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers
8.1
CVSS
0.3%
EPSS
No
On KEV
Description
Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim's subject or NameID, because account lookup ignores providerId, creating sessions for victim accounts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
sso · better-auth
1.7.0-rc.2 before 1.7.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110863
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110863
github.com
https://github.com/better-auth/better-auth/security/advisories/GHSA-mx9r-x6ww-qjw9
www.vulncheck.com
https://www.vulncheck.com/advisories/better-auth-better-auth-sso-before-1.7.3-authentication-bypass-via-personal-sso-providers
More from sso
9.6
CVE-2026-53513
Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration
8.1
CVE-2026-80192
better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass
8.1
CVE-2026-67328
@better-auth/sso before 1.6.21 Account Takeover via SSO
7.1
CVE-2026-53515
Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso