VULNERABILITY INTELLIGENCE
CVE-2026-67328
CVSS score8.1 HIGH
EPSS probability0.49%
CISA KEVNot currently listed
Published2026-08-01
Last modified2026-10-23
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Description
@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints to gain unauthorized session access and account takeover.
Weakness classification
- disclosure@vulncheck.com: CWE-79