Auth bypass in Better-Auth Sso
CVE-2026-80192
@better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line) contains two domain-ownership flaws. When domain verification is disabled, automatic organization assignment accepts unverified provider domains, allowing an authenticated organization owner/administrator to register an SSO provider for an arbitrary domain and have users with matching email domains added to the attacker's organization with default member permissions. When domain verification is enabled, a race condition between the verify-domain and update-provider endpoints can apply completed DNS proof to a different domain; combined with implicit account linking, this can link an attacker-controlled identity provider to an existing user account. Exploitation requires the SSO plugin (and, for the org-assignment path, the organization plugin) with the relevant configuration enabled.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.004 (28.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 28th percentile — 28.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.001
Affected products
Weakness classification (CWE)
References
- github.com/better-auth/better-auth/security/advisories/GHSA-8c5h-wx78-2cfg (vendor-advisory)
- www.vulncheck.com/advisories/better-auth-sso-before-1.6.27-domain-ownership-aut… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-80192?
- CVE-2026-80192 is a high-severity vulnerability in Better-Auth Sso, classified under Improper Authentication. CVSS score: 8.1/10. Published 2026-08-26.
- How severe is CVE-2026-80192?
- High severity. CVSS v3 base score is 8.1 out of 10.