CVE-2026-110863

Name of the Vulnerable Software and Affected Versions @better-auth/sso versions 1.7.0-rc.2 through 1.7.2

Description An authentication bypass allows authenticated users to sign in as other users by registering a personal Single Sign-On (SSO) provider. This occurs because the account lookup process ignores the providerId, enabling attackers to copy a legitimate provider's OpenID Connect (OIDC) issuer or Security Assertion Markup Language (SAML) entity ID and assert a victim's subject or NameID to create sessions for victim accounts.

Recommendations Update @better-auth/sso to version 1.7.3.