CVE-2026-110863— Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers
Quick assessment
Affected
better-auth sso
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer o
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110863
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers
Source: CVE Program / CVE List V5
Vulnerability Description
Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim's subject or NameID, because account lookup ignores providerId, creating sessions for victim accounts.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| better-auth | sso | 1.7.0-rc.2 ~ 1.7.3 | - |
|
II. Public POCs for CVE-2026-110863
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110863
请登录查看更多情报信息。
Other References for CVE-2026-110863 (2)
Same Patch Batch · better-auth · 2026-10-14 · 4 CVEs total
| CVE-2026-110862 | 9.1 CRITICAL | Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link |
| CVE-2026-110864 | 7.4 HIGH | Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy |
| CVE-2026-110861 | 3.7 LOW | Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition |
IV. Related Vulnerabilities
Same vendor: better-auth
-
CVE-2026-110864
Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass -
CVE-2026-110862
Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass -
CVE-2026-110861
Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit B -
CVE-2026-109346
better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorizat -
CVE-2026-80192
better-auth SSO before 1.6.27 Domain Ownership Authenticatio
Same weakness: CWE-287
-
CVE-2026-110864
Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass -
CVE-2026-110862
Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass -
CVE-2026-104108
FileRise OIDC login can bind an attacker identity to an exis -
CVE-2026-104105
FileRise: TOTP codes are not single-use — valid 6-digit code -
CVE-2026-69191
FileRise: Login Method Restriction Bypass via Direct API Acc
V. Comments for CVE-2026-110863
No comments yet