Better-auth SSO Vulnerability Analysis: Account Takeover via Multiple Defects

Vulnerability Overview @better-auth/sso: Account takeover via multiple SSO vulnerabilities This vulnerability involves four independent flaws, each allowing an attacker to log in to another user's account, resulting in account takeover. These flaws share a common characteristic: SSO logins are trusted as authentication when they should not be. Additionally, there is a patch upgrade issue. Affected Scope Affected Versions: - versions or earlier - versions to Affected Conditions: - Using the aforementioned versions of - Users or organization administrators registering SSO providers ( ) - Using default account linking ( is not set to ) Remediation Patch Versions: - Stable: Upgrade to or higher - 1.7.0 pre-release: Upgrade to or higher Workarounds: - Disable self-service SSO registration ( ) or place it behind admin review - Disable implicit account linking ( ) - Inspect the field in verified rows of the table to ensure there are no matching providers - For SAML, prioritize predefined providers and avoid sharing signing certificates across service providers - Keep unless necessary Details 1. Domain Verification Issue: - Domain verification can trust domains that do not belong to you. - Fix: Require each hostname to provide a list URL, path, and comma-separated input. 2. SSO Provider Deletion Issue: - Deleting an SSO provider leaves behind its linked accounts. - Fix: Delete linked account rows when the provider is deleted. 3. SAML Assertion Issue: - SAML assertions are not bound to the service provider. - Fix: Validate the of the assertion before creating a session. 4. Reflected XSS Issue: - During SAML Single Sign-On logout, the log handler constructs an auto-submitting form. - Fix: Only allow and URLs in the form . Impact Attackers can obtain valid sessions in victim user accounts without any action required from the victim. If the victim is an organization administrator, the attacker will gain those privileges. References CWE-287 (Improper Authentication) CWE-345 (Insufficient Verification of Data Authenticity) CWE-347 (Improper Verification of Cryptographic Signature) CWE-459 (Incomplete Cleanup) CWE-79 (Cross-site Scripting)

Goal Reached Thanks to every supporter — we hit 100%!

Better-auth SSO Vulnerability Analysis: Account Takeover via Multiple Defects

More from this source