The vulnerability CVE-2026-67328 affects better-auth sso versions prior to 1.6.21. It consists of multiple authentication bypass vulnerabilities due to improper handling of SSO providers. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, and reflected XSS on logout endpoints to gain unauthorized access by signing in as arbitrary users. The CVSS 4.0 score is 8.6 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. No official patch or remediation level is currently provided, and no known exploits in the wild have been reported.

Successful exploitation allows attackers to bypass authentication mechanisms and sign in as arbitrary users, resulting in unauthorized session access and potential account takeover. The reflected XSS on logout endpoints may also facilitate session hijacking or other client-side attacks. This compromises confidentiality and integrity of user accounts and sessions within the affected SSO system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should monitor vendor communications closely. No specific mitigations or temporary fixes are provided in the available data.