CVE-2026-67328 affects better-auth sso versions prior to 1.6.21 and involves multiple authentication bypass vulnerabilities in the handling of single sign-on (SSO) providers. The vulnerabilities arise from domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, and reflected XSS on logout endpoints. These flaws enable attackers to bypass authentication controls and impersonate arbitrary users, potentially resulting in unauthorized session access and account takeover. The CVSS 4.0 base score is 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

Successful exploitation allows attackers to bypass authentication mechanisms and gain unauthorized access to user sessions, leading to account takeover. This compromises confidentiality and integrity of user accounts and sessions within the better-auth sso system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates and consider restricting access or implementing additional authentication controls to mitigate risk.