What is CVE-2026-67328?

CVE-2026-67328 is a high-severity vulnerability in Better-auth Sso, classified under Cross-site Scripting. CVSS score: 8.1/10. Published 2026-08-01.

How severe is CVE-2026-67328?

High severity. CVSS v3 base score is 8.1 out of 10.

XSS in Better-auth Sso

CVE-2026-67328

@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orpha…

Vulnerability class: XSS (Cross-Site Scripting)

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Better-auth Sso — versions 0, 1.6.21, 1.7.0-beta.0

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-67328?: CVE-2026-67328 is a high-severity vulnerability in Better-auth Sso, classified under Cross-site Scripting. CVSS score: 8.1/10. Published 2026-08-01.
How severe is CVE-2026-67328?: High severity. CVSS v3 base score is 8.1 out of 10.